{"id":"CVE-2026-124041","kind":"vulnerability","aliases":["CVE-2026-124041"],"related":[],"title":"Patriot Properties WebPro: unauthenticated SQL injection exposes property and taxpayer data","description":"Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and  taxpayer information.","summary":"Catalis/Patriot Properties WebPro 5.0 lets a remote attacker with no login run arbitrary SQL queries against its MSSQL database. An attacker can use this to pull sensitive property and taxpayer records.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mssql","patriot-properties","vendor","webpro"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","triaged_at":"2026-11-13T18:51:40+00:00","updated_at":"2026-11-13T18:51:40+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-13T18:51:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Patriot Properties WebPro: unauthenticated SQL injection exposes property and taxpayer data","impact":"high","summary":"Catalis/Patriot Properties WebPro 5.0 lets a remote attacker with no login run arbitrary SQL queries against its MSSQL database. An attacker can use this to pull sensitive property and taxpayer records.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["webpro","patriot-properties","mssql"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads sensitive property and taxpayer records from the database","analyst_note":"Check the NVD entry and the vendor advisory for affected versions, a fixed release, and whether the flaw is reachable over the internet by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"WebPro 5.0 from Catalis/Patriot Properties, used by property and tax offices, is the affected product as the sources describe it. The sources do not say which deployments are exposed to the internet or what configuration matters. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000683,"input_tokens":4548,"output_tokens":456,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124041':14A,17A '-2026':13A,16A '5.0':27B,58C 'allow':59C 'arbitrari':36B,66C 'attack':31B,44B,63C 'catalis/patriot':24B,55C 'cve':12A,15A 'data':11A 'databas':42B,73C 'enabl':74C 'execut':65C 'exfiltr':75C 'expos':7A 'inform':81C 'inject':6A 'let':28B 'login':34B 'mssql':18B,41B,72C 'patriot':1A,20B 'patriot-properti':19B 'properti':2A,8A,21B,25B,51B,56C,78C 'pull':49B 'queri':38B,68C 'record':54B 'remot':30B,61C 'run':35B 'sensit':50B,77C 'sql':5A,37B,67C 'taxpay':10A,53B,80C 'unauthent':4A,62C 'under':71C 'use':46B 'vendor':22B 'webpro':3A,23B,26B,57C","nicknames":[],"mitigations":[],"who_affected":"WebPro 5.0 from Catalis/Patriot Properties, used by property and tax offices, is the affected product as the sources describe it. The sources do not say which deployments are exposed to the internet or what configuration matters. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mssql","patriotproperties","vendor","webpro"],"campaign_type":null,"search_a":"'-124041':14A,17A '-2026':13A,16A 'cve':12A,15A 'data':11A 'expos':7A 'inject':6A 'patriot':1A 'properti':2A,8A 'sql':5A 'taxpay':10A 'unauthent':4A 'webpro':3A","search_b":"'5.0':27B 'arbitrari':36B 'attack':31B,44B 'catalis/patriot':24B 'databas':42B 'let':28B 'login':34B 'mssql':18B,41B 'patriot':20B 'patriot-properti':19B 'properti':21B,25B,51B 'pull':49B 'queri':38B 'record':54B 'remot':30B 'run':35B 'sensit':50B 'sql':37B 'taxpay':53B 'use':46B 'vendor':22B 'webpro':23B,26B","search_c":"'5.0':58C 'allow':59C 'arbitrari':66C 'attack':63C 'catalis/patriot':55C 'databas':73C 'enabl':74C 'execut':65C 'exfiltr':75C 'inform':81C 'mssql':72C 'properti':56C,78C 'queri':68C 'remot':61C 'sensit':77C 'sql':67C 'taxpay':80C 'unauthent':62C 'under':71C 'webpro':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124041","severity":null,"published_at":"2026-11-13T18:17:31+00:00","modified_at":"2026-11-13T18:17:31+00:00","first_seen_at":"2026-11-13T18:49:28+00:00","fetched_at":"2026-11-13T18:49:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}