CVE-2026-108474

{
  "etk_id": "ETK-2026-1115",
  "cve_id": "CVE-2026-108474",
  "display_id": "CVE-2026-108474",
  "ghsa_id": "GHSA-cv5g-jv44-53r2",
  "euvd_id": "EUVD-2026-96025",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in JetBrains Exposed SQL functions",
  "summary": "JetBrains Exposed versions before 1.5.1 are affected by SQL injection involving unescaped string arguments in several SQL functions. An attacker may be able to manipulate database queries where an application passes attacker-controlled strings to the affected functions.",
  "mitigation": "Upgrade JetBrains Exposed to version 1.5.1 or later. Until upgraded, avoid passing untrusted string input to SQL functions that may not escape arguments.",
  "vendor": "JetBrains",
  "product": "Exposed",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.5.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.5.1"
      ],
      "package_name": "Exposed",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0032,
  "epss_percentile": 0.2351,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 19.889758433333334,
  "t0_at": "2026-10-09T23:13:49.532000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-10T00:56:42.667311+00:00",
      "days": 0.07144832535879629,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T23:13:49.532000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T23:13:49.532000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T23:13:49.532000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108474"
    }
  }
}