CVE-2026-108474: SQL Injection
Published Oct 9, 2026
·Updated
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
Affected Software
1 affected component
JetBrains Exposed<1.5.1
Event History
Oct 9, 2026
CVE Published
via MITRE·11:13 PM
Data Sourced
via MITRE·11:13 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
JetBrains Exposed versions before 1.5.1 are affected where several SQL functions receive unescaped string arguments. Deployments using those functions should be prioritized for review.
2
Does exploitation require authentication or user interaction?
The CVSS vector indicates network exploitation with low attack complexity, no required privileges, and no user interaction. It also indicates high potential impact to confidentiality, integrity, and availability.