CVE-2026-6888

SQL Injection Vulnerability

State: Published
Severity: 7.2 High
Published: May 13, 2026
Updated: May 13, 2026
Reserved: Apr 23, 2026

Description

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to access, modify, or delete sensitive information within the database.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CSA

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
SaaS ComposerAdvantech	prior to version 3.4.17Affected
IoTSuite Growth Linux dockerAdvantech	prior to version 2.2.0Affected
IoTSuite Starter Linux dockerAdvantech	prior to version 2.2.0Affected
IoT Edge Linux dockerAdvantech	prior to version 2.2.0Affected
IoT Edge WindowsAdvantech	prior to version 2.2.0Affected
WebAccess/SCADAAdvantech	prior to version 9.2.3Affected
WebAccess SaaS-ComposerAdvantech	prior to version 3.4.17.1Affected
ECOWatch SaaS-ComposerAdvantech	prior to version 3.4.17Affected

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-050/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.