PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[EN] CVE-2026-44706: SQL Injection in Chatwoot FilterService

yokai.hakaisecurity.io | vulnerability | CVE-2026-44706 | #vulnerability-research | #sql-injection | #research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Summary The Hakai Security Research Team has identified a critical SQL Injection vulnerability in Chatwoot versions <= 4.11.1 that allows any authenticated agent to read the entire PostgreSQL database, including user credentials and API tokens. The vulnerability resides in the FilterService method, where user input is directly interpolated into SQL queries without parameterization. Exploitation requires […]
CVE
CVE-2026-44706
Published
Collected

Related coverage

vulnerability · yokai.hakaisecurity.io
[PT-BR] CVE-2026-44706: SQL Injection in Chatwoot FilterService
Resumo A Equipe de Pesquisa da Hakai identificou uma vulnerabilidade crítica de Injeção de SQL nas versões do Chatwoot <= 4.11.1 que permite a qualquer agente autenticado ler todo o banco de dados PostgreSQL, incluindo credenciais de usuários e tokens de API. A vulnerabilidade reside no método FilterService, onde a entrada do usuário é inserida diretamente […]
vulnerability · yokai.hakaisecurity.io
GLPI - SQL injection through dynamic reports
This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users’ credentials and potentially some Remote Code Execution (RCE) […]
vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
vulnerability · horizon3.ai
CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1
OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…
research · yokai.hakaisecurity.io
SQL Injection e Vulnerabilidade XSS no Centreon
Eu sou Daniel França Lima e sou pentester Jr e pesquisador de vulnerabilidades na Hakai Offensive Security. Com o objetivo de ajudar a comunidade de hackers, empresas e também aprimorar minhas habilidades, periodicamente busco por falhas em aplicativos do mercado com o objetivo de realizar divulgação responsável. Centreon é uma solução de monitoramento de ativos […]
Back