SQL Injection Vulnerability in Znuny Ticketing System by Znuny
CVE-2026-93484

8.6HIGH

Key Information:

Vendor

Znuny

Status
Znuny
Vendor
CVE Published:
15 October 2026

What is CVE-2026-93484?

The Znuny Ticketing System versions up to 7.3.6 are susceptible to SQL Injection due to inadequate sanitization of user input in ticket-search database queries. An attacker can manipulate the ContentSearch parameter, which is expected to receive values such as 'AND' or 'OR'. This unsecured concatenation allows the execution of arbitrary SQL commands, potentially leading to unauthorized data access, modification, or even a denial of service. Users of this system should apply the necessary updates or patches to safeguard their data.

Affected Version(s)

Znuny 0 < 6.5.25

Znuny 7.0.0 < 7.3.7

References

https://www.znuny.org/advisories
https://www.znuny.org/en/advisories/zsa-2026-15

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.