Live › vulnerability › CVE-2026-111444
Go to dashboardWheels (a Python-style ORM/framework package) allows SQL injection on MySQL/MariaDB when backslash escaping is enabled and request data reaches inline-literal query paths. An attacker who controls that input can alter the SQL query, which can expose or change database data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
4.1.2 is affected) and whether any query uses parameterize=false, IN lists, BETWEEN, function arguments or LIKE ESCAPE with request data4.2.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-111444")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.