CVE-2026-93484

{
  "etk_id": "ETK-2026-1641",
  "cve_id": "CVE-2026-93484",
  "display_id": "CVE-2026-93484",
  "ghsa_id": "GHSA-mxcg-m44c-38cw",
  "euvd_id": "EUVD-2026-101821",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Znuny ticket search",
  "summary": "Znuny ticket search processing is vulnerable to SQL injection through the ContentSearch input. An attacker able to influence that input can cause unintended database operations, potentially exposing or changing data or disrupting service.",
  "mitigation": "Upgrade Znuny 6.5 deployments to 6.5.25 or later, or 7.3 deployments to 7.3.7 or later. Restrict access to ticket-search functionality until the update is applied.",
  "vendor": "Znuny",
  "product": "Znuny",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 6.5.25",
        ">= 7.0.0, < 7.3.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "6.5.25",
        "7.3.7"
      ],
      "package_name": "Znuny",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Amber",
  "epss_score": 0.003,
  "epss_percentile": 0.2135,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 41.70715915,
  "t0_at": "2026-10-15T03:50:36.324000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T05:15:45.472545+00:00",
      "days": 0.05913366371527778,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T03:50:36.324000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T03:50:36.324000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T03:50:36.324000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93484"
    }
  }
}