{"id":"EM-20261109-L8DX","url":"https://cyber.eventmonitor.net/incident/EM-20261109-L8DX/vulnerability-cve-2026-124850/","type":"cve","title":"Vulnerability (CVE-2026-124850)","subtitle":"CVE-2026-124850","subject":"CVE-2026-124850","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-09T15:17:19.020Z","firstSignal":"2026-11-09T14:43:27.000Z","lastSignal":"2026-11-09T15:17:19.020Z","updated":"2026-11-09T16:17:41.628Z","revision":1,"life":[{"status":"Born","at":"2026-11-09T15:17:19.020Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-09T15:17:19.020Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T14:43:27.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-09T15:17:19.020Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261109-L8DX created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T15:17:19.020Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T15:17:19.020Z","detail":"CVSS 7.3"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T14:43:27.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":3,"title":"EUVD-2026-120079 / CVE-2026-124850 (score 7.3)","text":"A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious…","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120079"},{"at":"2026-11-09T15:17:19.020Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-124850 (CVSS 7.3)","text":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious identifier value into the affected tables can cause arbitrary SQL execution when the migration is subsequently run during an application upgrade.\n\n- Requires prior write access to the database to plant a malicious identifier value\n- Triggered automatically during a migration or upgrade operation\n- Can…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124850"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T15:17:19.020","score":7.3,"severity":"HIGH","desc":"A SQL injection vulnerability exists in a database migration script in flowintel.\n\nThe migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has previously written a malicious…","product":"","seen":1794241061628},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}