CVE-2026-32599

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.26%

CWE

CWE-89

Published

2026-09-15

Last modified

2026-09-16

Affected products

• gravitl netmaker

Weakness type

• CWE-89

Related vulnerabilities

• CVE-2026-76461 — Cisco Secure Email Gateway SQL Injection Vulnerability
• CVE-2026-67401 — A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTr
• CVE-2026-61667 — DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval
• CVE-2026-18658 — IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
• CVE-2026-9163 — SQLi in GIS Informatics' GisLab Laboratory Management System
• CVE-2026-86460 — Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
• CVE-2026-82232 — Apache Syncope: SQL injection via sort parameter in Task search
• CVE-2026-77051 — Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Markdown version · Browse all CVEs