PT-2026-81275

CVE-2026-78864

Published

2026-08-25

Updated

2026-08-25

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions liketrek TREK versions prior to 3.1.0

Description An issue in the Journey Entry Update component allows for remote SQL injection. This occurs within the journeyService.updateEntry() function located in the server/src/nest/journey/journey.controller.t file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Upgrade to version 3.1.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Bytejmp

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')