{"id":"EM-20261106-YTXC","url":"https://cyber.eventmonitor.net/incident/EM-20261106-YTXC/vulnerability-cve-2026-123087/","type":"cve","title":"Vulnerability (CVE-2026-123087)","subtitle":"CVE-2026-123087","subject":"CVE-2026-123087","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-06T10:16:37.403Z","firstSignal":"2026-11-06T09:30:48.000Z","lastSignal":"2026-11-06T10:16:37.403Z","updated":"2026-11-06T10:57:48.170Z","revision":1,"life":[{"status":"Born","at":"2026-11-06T10:16:37.403Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-06T10:16:37.403Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T09:30:48.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-06T10:16:37.403Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261106-YTXC created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T10:16:37.403Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T10:16:37.403Z","detail":"CVSS 8.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T09:30:48.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":3,"title":"EUVD-2026-118028 / CVE-2026-123087 (score 8.7)","text":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118028"},{"at":"2026-11-06T10:16:37.403Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-123087 (CVSS 8.7)","text":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123087"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T10:16:37.403","score":8.7,"severity":"HIGH","desc":"SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input…","product":"","seen":1793962668170},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}