SQL Injection Vulnerability in SOPlanning by SOPlanning
CVE-2026-40546

8.7HIGH

Key Information:

Vendor

Soplanning

Status
Soplanning
Vendor
CVE Published:
1 June 2026

What is CVE-2026-40546?

SOPlanning is exposed to an SQL Injection vulnerability affecting multiple endpoints and parameters. Attackers with low-level access can exploit this flaw to inject arbitrary SQL commands, which may lead to unauthorized access and control over the database. This vulnerability affects versions of SOPlanning up to and including version 1.55, posing a significant risk to users who have not updated to secure versions.

Affected Version(s)

SOPlanning 0 <= 1.55

References

https://cert.pl/en/posts/2026/06/CVE-2026-40543
third-party-advisory
https://www.soplanning.org/en/
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Łukasz Jaworski
.