CVE-2026-110614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110614
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110614.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110614
Published
2026-10-14T14:16:53Z
Modified
2026-10-17T02:30:33Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
Details

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110614.json"
}
References

Affected packages

Git / github.com/yiuman/citrus

Affected ranges

Type
GIT
Repo
https://github.com/yiuman/citrus
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4967a932ed7bbb4790b56f4299de1981d66979e7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "0.15.0"
        },
        {
            "fixed":  "0.15.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

0.*
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0.RELEASE
0.1.2.RELEASE
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110614.json"