Vulnerability Report

CVE-2026-52758

Title: CVE-2026-52758

SQLi

Proof Of Concept

No public PoC currently indexed for CVE-2026-52758.

CWE Category CWE-89

Published Date Jun 10, 2026

Modified Date Jun 11, 2026

Exploit Status Not Found

Score 8.7 CVSS v4.0

Exploit Probability (EPSS)

0.08%

Vulnerability Summary

CVE-2026-52758: Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Impacted Vendors

nsa 1

Reference Links

https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-8r4f-65cr-fwxm https://www.vulncheck.com/advisories/ghidra-sql-injection-via-unescaped-filter-values-in-bsim-search

CVSS v4.0

Source Entity [email protected]

Severity HIGH

8.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1