---
id: "CVE-2026-74993"
kind: "vulnerability"
aliases: ["CVE-2026-74993"]
title: "Starnet Inventory Tracking Application: SQL injection lets attackers read database data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Inventory Tracking Application", "fixed": [], "affected": "through 2026-10-16", "ecosystem": "vendor"}]
ecosystems: []
tags: ["inventory-tracking", "other", "starnet"]
not_affected_if: []
published_at: "2026-11-02T14:17:37+00:00"
first_seen_at: "2026-11-02T14:23:24+00:00"
updated_at: "2026-11-02T14:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74993", "first_seen_at": "2026-11-02T14:23:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T14:26:40+00:00"}]
---

# Starnet Inventory Tracking Application: SQL injection lets attackers read database data

SQL injection (CWE-89) in Starnet Computer and Network Systems' Inventory Tracking Application, versions through 2026-10-16. The CNA (USOM) rates it network-reachable, no login needed, with high impact on confidentiality only, so an attacker could read the database. The vulnerable input and any fixed release are not published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Inventory Tracking Application affected through 2026-10-16 fixed ?

## How to check

unknown: the NVD entry gives only a date-based range (through 2026-10-16) and no vulnerable parameter. If you run Starnet's Inventory Tracking Application, check the build date with the vendor and ask Starnet for a fixed release.

## Timeline

- 2026-11-02T14:23:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74993
- 2026-11-02T14:26:40+00:00 analyst — NVD record (CNA USOM) read via API: SQLi CWE-89, affected 'through 2026-10-16' (date-versioned), CVSS vector is C:H/I:N/A:N, i.e. data read, not modify. USOM advisory TR-26-1441 would not render; no vendor page, no fix, no vulnerable input found. Not exploited as far as sources say.

## Documents

- [describes] NVD: CVE-2026-74993 https://nvd.nist.gov/vuln/detail/CVE-2026-74993

## From the sources

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection.

This issue affects Inventory Tracking Application: through 2026-10-16.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_