CVE-2026-72507

Summary

The flaw is a time-based blind SQL injection vulnerability in the 'reportType' parameter, allowing attackers to inject malicious SQL queries and potentially gain unauthorized access or manipulate data. This matters because it can lead to severe data breaches and system compromise.

Exploitability

Exploitation requires knowledge of the specific SQL injection technique and access to the 'reportType' parameter. Precondition is that the feature is enabled and the application is not properly sanitized.

Blast radius

If exploited, this vulnerability could lead to data theft, unauthorized data manipulation, and potential system compromise affecting users and operations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the 'reportType' parameter until a patch is available.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.