CVE-2026-94143
drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
CVSS Score
7.3
EPSS Score
0.3%
EPSS Percentile
17th
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-89 CWE-74 |
| Vendor | drogonframework |
| Product | drogon |
| Published | Sep 21, 2026 |
| Last Updated | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for drogonframework drogon
Be the first to know when new high vulnerabilities affecting drogonframework drogon are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
drogonframework / drogon
1.9.0 1.9.1 1.9.2 1.9.3 1.9.4 1.9.5 1.9.6 1.9.7 1.9.8 1.9.9 1.9.10 1.9.11 1.9.12 1.9.13
References
vuldb.com: https://vuldb.com/vuln/408058 vuldb.com: https://vuldb.com/vuln/408058/cti vuldb.com: https://vuldb.com/cve/CVE-2026-94143 vuldb.com: https://vuldb.com/submit/893923 github.com: https://github.com/drogonframework/drogon/issues/2575 gist.github.com: https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf github.com: https://github.com/drogonframework/drogon/
Credits
🔍 hacja (VulDB User) VulDB CNA Team