CVE-2026-39747

Summary

This flaw allows SQL injection for subscribers in Woffice versions 5.4.35 and earlier, enabling attackers to manipulate database queries and potentially gain unauthorized access to sensitive data.

Exploitability

Exploitation requires access to the application and knowledge of the SQL injection vulnerability. Precondition is the use of an affected Woffice version.

Blast radius

If exploited, the impact could be high, as it allows unauthorized access to subscriber data, potentially leading to data breaches or loss of confidentiality.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Woffice 5.4.36 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.