CVE-2026-94144

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14

Description A flaw in the ORM component affects the makeCriteria() function within the orm lib/src/Criteria.cc library. A remote attacker can perform a SQL injection by manipulating the filter argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update drogonframework drogon to version 1.9.14 or later. As a temporary workaround, restrict the use of the makeCriteria() function until the update is applied.