CVE-2026-115330High· 8.8▾ TwilightLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL thr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
lotus <= 0.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115331High· 8.8Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
CVE-2026-115332High· 8.8Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
CVE-2026-115329Medium· 5.9Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0