PT-2026-55232 · Ubiquiti · Unifi Talk
CVE-2026-50747
·
Published
2026-07-02
·
Updated
2026-07-16
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
UniFi Talk Application (affected versions not specified)
Description
An authenticated SQL Injection issue exists in the UniFi Talk Application. A malicious actor with network access and low privileges can exploit this flaw to escalate privileges on the host device. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to or manipulation of the database.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
LPE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Unifi Talk