org.apache.sis.storage:sis-sqlstore vulnerabilities

CVEs whose affected-version data names the org.apache.sis.storage:sis-sqlstore package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110733Medium· 5.4

today

Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue …

▾ SunlitApache Software Foundation · org.apache.sis.storage:sis-sqlstorevia CVEORG