CVE-2026-124041: Catalis WebPro SQL Injection

Published Nov 13, 2026

Updated

Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.

Affected Software

1 affected component

Catalis WebPro=5.0

Event History

Nov 13, 2026

CVE Published

via MITRE·05:11 PM

Data Sourced

via MITRE·05:11 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Any deployment of Catalis/Patriot Properties WebPro 5.0 that is reachable remotely is exposed, because exploitation requires no authentication or user interaction.

What could an attacker access or do?

An attacker can execute arbitrary SQL queries against the underlying MSSQL database. This can enable exfiltration of sensitive property and taxpayer information, and the listed impact includes low confidentiality and integrity impact.

How can we tell whether this affects our environment?

Confirm whether your organization runs Catalis/Patriot Properties WebPro version 5.0 and whether the application is remotely reachable. The provided information does not identify a specific vulnerable endpoint or detection indicator.

CVE-2026-124041: Catalis WebPro SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What could an attacker access or do?

How can we tell whether this affects our environment?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What could an attacker access or do?

How can we tell whether this affects our environment?