CVE-2026-115331High· 8.8▾ TwilightLotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
lotus <= 0.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115330High· 8.8Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
CVE-2026-115332High· 8.8Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
CVE-2026-115333Medium· 5.9Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
CVE-2026-115334Medium· 6.8Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
CVE-2026-115329Medium· 5.9Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0