CVE-2026-110668
7.3HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the underlying database via public exploit payloads. They only need network access to the web interface.
Root cause
The sort parameter in the index function of sar2html.py is concatenated directly into SQL queries without sanitization.
Affected systems
cemtan sar2html 4.0.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No fixed version is currently available as the maintainer has not responded. Take the application offline or restrict network access to trusted IPs only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.