CVE-2026-52472
A critical SQL injection flaw exists in Wgcloud version 3.6.4. The vulnerability allows a remote attacker to send malicious SQL through the PortInfoMapper.xml file, potentially taking full control of the system. No public exploit or patch is currently available.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Wgcloud 3.6.4
Real-world impact
An attacker could inject arbitrary SQL commands, escalating privileges to gain full control over the affected system, including reading, modifying, or deleting data and executing arbitrary code.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network (AV:N), requires no authentication (PR:N), and has no user interaction (UI:N). It can compromise confidentiality, integrity, and availability, giving attackers complete control.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources