CVE-2026-115330

8.8 HIGHpublic exploit available

Published 2026-10-22 · Updated 2026-10-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/uselotus/lotus
https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656

All references

https://github.com/uselotus/lotus
https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656
https://hackmd.io/@leediay/BkUc3WL2Mx
https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2015-20122
HIGHCVE-2015-20128PoC
HIGHCVE-2019-25776PoC
HIGHCVE-2019-25778PoC
HIGHCVE-2021-48008
HIGHCVE-2022-4997
HIGHCVE-2022-51021PoC
HIGHCVE-2022-51023PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.