CVE-2026-111634

EUVD-2026-103056
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.07%
Common Weakness Enumeration
References
https://github.com/helicalinsight/helicalinsight/blob/v7.0.0/server/core/src/main/java/com/helicalinsight/datasource/EfwdQueryProcessor.java#L220-L235
https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli
https://www.vulncheck.com/advisories/helical-insight-through-7.0.0-sql-injection-via-executedatasource
https://hackmd.io/@hieuPenguinnn/helicalinsight-efwd-parameter-sqli