Daily Digest
The single most urgent item this cycle is CVE-2026-103253 (CVSS 8.7, HIGH) affecting the Oracle Database node in n8n, which permits SQL injection via the Delete Table Drop operation, allowing arbitrary DDL/DML execution against connected databases using the credential's privileges. While no entries in this digest are currently flagged as CISA KEV-confirmed, CVE-2024-58374 (Microsoft SQL Server scope) carries observed exploitation evidence from the Shadowserver Foundation, and CVE-2026-104457 (MySQL scope) presents an unauthenticated SQL injection risk on default YesWiki installs. Given the healthcare environment, any workflow automation (n8n) or patient-facing wiki endpoints (YesWiki) connected to clinical databases require immediate review, alongside the MobilityDB denial-of-service risk for PostgreSQL instances in the homelab.
Summary: YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, where unescaped filterN attribute tokens are wrapped in quotes and concatenated into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup with a trailing-backslash token to break quote parity under MySQL backslash escaping, enabling a five-column UNION subquery to read arbitrary table data such as password hashes.
Affected Features / Interoperability: Bazar filtertags action and page markup parsing. Downstream impact includes potential exposure of user credentials and arbitrary data read from the connected MySQL database, affecting any YesWiki deployment integrated with patient or staff data.
Source:
Actions:
Summary: The Restaurant-Management-System up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c contains an SQL injection in the mysqli_query function of User/cancel.php within the Order Cancellation component. The manipulation of the ID argument leads to SQL injection, and the attack may be initiated remotely; the exploit is publicly available.
Affected Features / Interoperability: Order Cancellation component and the mysqli_query database call. Downstream impact includes unauthorized data manipulation or extraction from the connected database via the order cancellation workflow.
Source:
Actions:
Summary: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions 9.0.0-9.4.0 are affected by an easily exploitable vulnerability allowing a high-privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.
Affected Features / Interoperability: MySQL Server Optimizer component. Downstream impact is denial of service affecting the entire instance, which could disrupt replication, client connections, and dependent applications relying on database availability.
Source:
Actions:
Summary: MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic. Unprivileged database users can crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field, causing memcpy() to operate with a corrupted unbounded length and resulting in a remote denial-of-service condition affecting all sessions on the instance.
Affected Features / Interoperability: MobilityDB MEOS binary/library WKB deserialization. Downstream impact affects all sessions on the PostgreSQL instance, including replication and any geospatial time-series analytics relying on the MobilityDB extension.
Source:
Actions:
Summary: n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.
Affected Features / Interoperability: n8n Oracle Database node, specifically the Delete Table Drop operation. Downstream impact includes arbitrary DDL/DML execution against connected Oracle databases, risking data integrity, schema modification, and credential theft via the workflow service account.
Source:
Actions:
Summary: YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
Affected Features / Interoperability: Bazar list option ids and the newtextsearch action. Downstream impact includes blind data exfiltration from the connected database, including administrative credentials, affecting any YesWiki deployment integrated with sensitive data.
Source:
Actions:
Summary: Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).
Affected Features / Interoperability: getSdutyTree servlet endpoint and oauthservlet authentication filter. Downstream impact includes unauthorized access to protected resources and retrieval of user credentials from the connected Microsoft SQL Server, affecting HR and personnel data systems.
Source:
Actions:
Note: The following items are unverified community chatter and supplementary mentions, separate from the Formal Vulnerabilities above.
User Safety: safe