CVE-2026-19354: lock-upme OPMS IN Clause message.go sql injection
A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19354?
The severity of CVE-2026-19354 is rated as medium with a score of 6.3.
How do I fix CVE-2026-19354?
To fix CVE-2026-19354, ensure validation and sanitization of inputs in the SQL query handling to prevent SQL injection.
What type of vulnerability is CVE-2026-19354?
CVE-2026-19354 is a SQL Injection vulnerability.
What component of lock-upme OPMS is affected by CVE-2026-19354?
CVE-2026-19354 affects the IN Clause Handler in the file controllers/messages/message.go.
What can attackers achieve through CVE-2026-19354?
Attackers can perform SQL injection by manipulating the argument ids, potentially compromising database integrity.