CVE-2026-102491 - mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

Back Back to CVE browser

MEDIUM

mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection

Published Sep 29, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.25%

Description

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Mahonelau Product Kykms Default
n/a
- Version
  
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mahonelau

Kykms

n/a

Version	Status	Constraints
	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://github.com/fangtang7/CVE/blob/main/kykms/sql.md
exploit
https://vuldb.com/cve/CVE-2026-102491
third-party-advisory
https://vuldb.com/submit/942093
third-party-advisory
https://vuldb.com/vuln/411276
vdb-entrytechnical-description
https://vuldb.com/vuln/411276/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/fangtang7/CVE/blob/main/kykms/sql.md		exploit
https://vuldb.com/cve/CVE-2026-102491		third-party-advisory
https://vuldb.com/submit/942093		third-party-advisory
https://vuldb.com/vuln/411276		vdb-entrytechnical-description
https://vuldb.com/vuln/411276/cti		signaturepermissions-required