{"schema_version":"2","view":"grouped","data":[{"id":56351,"cve_ids":["CVE-2026-115997"],"payload":{"kind":"advisory","title":"pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection","summary":"A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115997","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115997","aliases":["CVE-2026-115997"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:pig-mesh:pig:*:*:*:*:*:*:*:*"],"vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"4.0"},{"status":"affected","version":"4.1.0"},{"status":"unaffected","version":"4.1.1"}]}],"modified":"2026-10-24T23:45:22.667Z","provider":"cve","references":["https://vuldb.com/vuln/426095","https://vuldb.com/vuln/426095/cti","https://vuldb.com/cve/CVE-2026-115997","https://vuldb.com/submit/991961","https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md","https://github.com/pig-mesh/pig/pull/1289","https://github.com/pig-mesh/pig/commit/9b6311161e346d7626c81d993044072fed2dca07","https://github.com/pig-mesh/pig/releases/tag/v4.1.1","https://github.com/pig-mesh/pig/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T23:45:22.667Z"}}},"related_cves":[{"value":"CVE-2026-115997","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115997","advisory_id":"f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","event_types":["advisory"],"published_at":"2026-10-25T16:13:12.018753+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T23:45:22.667+00:00","detail_url":"/advisories/advisory%3Af192f274-4d8e-47e6-b6e8-3bc483ac1f2c","group":{"id":"advisory:f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","revision":1,"primary_event_id":55874,"change":"published","superseded_by":[],"changed":{"id":55874,"cve_ids":["CVE-2026-115997"],"payload":{"kind":"advisory","title":"pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection","summary":"A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115997","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115997","aliases":["CVE-2026-115997"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:pig-mesh:pig:*:*:*:*:*:*:*:*"],"vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"4.0"},{"status":"affected","version":"4.1.0"},{"status":"unaffected","version":"4.1.1"}]}],"modified":"2026-10-24T23:45:22.667Z","provider":"cve","references":["https://vuldb.com/vuln/426095","https://vuldb.com/vuln/426095/cti","https://vuldb.com/cve/CVE-2026-115997","https://vuldb.com/submit/991961","https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md","https://github.com/pig-mesh/pig/pull/1289","https://github.com/pig-mesh/pig/commit/9b6311161e346d7626c81d993044072fed2dca07","https://github.com/pig-mesh/pig/releases/tag/v4.1.1","https://github.com/pig-mesh/pig/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T23:45:22.667Z"}}},"related_cves":[{"value":"CVE-2026-115997","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115997","advisory_id":"f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","event_types":["advisory"],"published_at":"2026-10-25T16:13:12.018753+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T23:45:22.667+00:00","detail_url":"/events/55874"},"members":[{"id":55874,"cve_ids":["CVE-2026-115997"],"payload":{"kind":"advisory","title":"pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection","summary":"A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 4.1.1 will fix this issue. This patch is called 9b6311161e346d7626c81d993044072fed2dca07. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure.","evidence":"cve:CVE-2026-115997","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-115997","aliases":["CVE-2026-115997"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:pig-mesh:pig:*:*:*:*:*:*:*:*"],"vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"4.0"},{"status":"affected","version":"4.1.0"},{"status":"unaffected","version":"4.1.1"}]}],"modified":"2026-10-24T23:45:22.667Z","provider":"cve","references":["https://vuldb.com/vuln/426095","https://vuldb.com/vuln/426095/cti","https://vuldb.com/cve/CVE-2026-115997","https://vuldb.com/submit/991961","https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md","https://github.com/pig-mesh/pig/pull/1289","https://github.com/pig-mesh/pig/commit/9b6311161e346d7626c81d993044072fed2dca07","https://github.com/pig-mesh/pig/releases/tag/v4.1.1","https://github.com/pig-mesh/pig/"],"provider_metadata":{"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-10-24T23:45:22.667Z"}}},"related_cves":[{"value":"CVE-2026-115997","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-115997","advisory_id":"f192f274-4d8e-47e6-b6e8-3bc483ac1f2c","event_types":["advisory"],"published_at":"2026-10-25T16:13:12.018753+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-24T23:45:22.667+00:00","detail_url":"/events/55874"}]}},{"id":45454,"cve_ids":["CVE-2026-111343"],"payload":{"kind":"advisory","title":"pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}","summary":"pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.","evidence":"cve:CVE-2026-111343","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111343","aliases":["CVE-2026-111343"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"4.1.1"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-10-21T01:44:35.077Z","provider":"cve","references":["https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","https://github.com/pig-mesh/pig/blob/v4.1.1/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysUserController.java#L94-L102","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-through-4.1.1-missing-authorization-via-get-admin-user-details-id"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111343","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T01:44:12.757138Z"}}}],"references":[{"url":"https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:44:35.077Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-15T21:43:35.878Z"}}},"related_cves":[{"value":"CVE-2026-111343","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a0abc11c-fa4f-4710-9709-7527c1d43813","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111343","advisory_id":"a0abc11c-fa4f-4710-9709-7527c1d43813","event_types":["advisory"],"published_at":"2026-10-25T12:26:22.123129+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T21:43:35.878+00:00","detail_url":"/advisories/advisory%3Aa0abc11c-fa4f-4710-9709-7527c1d43813","group":{"id":"advisory:a0abc11c-fa4f-4710-9709-7527c1d43813","revision":1,"primary_event_id":45019,"change":"published","superseded_by":[],"changed":{"id":45019,"cve_ids":["CVE-2026-111343"],"payload":{"kind":"advisory","title":"pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}","summary":"pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.","evidence":"cve:CVE-2026-111343","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111343","aliases":["CVE-2026-111343"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"4.1.1"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-10-21T01:44:35.077Z","provider":"cve","references":["https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","https://github.com/pig-mesh/pig/blob/v4.1.1/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysUserController.java#L94-L102","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-through-4.1.1-missing-authorization-via-get-admin-user-details-id"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111343","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T01:44:12.757138Z"}}}],"references":[{"url":"https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:44:35.077Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-15T21:43:35.878Z"}}},"related_cves":[{"value":"CVE-2026-111343","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a0abc11c-fa4f-4710-9709-7527c1d43813","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111343","advisory_id":"a0abc11c-fa4f-4710-9709-7527c1d43813","event_types":["advisory"],"published_at":"2026-10-25T12:26:22.123129+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T21:43:35.878+00:00","detail_url":"/events/45019"},"members":[{"id":45019,"cve_ids":["CVE-2026-111343"],"payload":{"kind":"advisory","title":"pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}","summary":"pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments.","evidence":"cve:CVE-2026-111343","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-111343","aliases":["CVE-2026-111343"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","versionType":"semver","lessThanOrEqual":"4.1.1"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-10-21T01:44:35.077Z","provider":"cve","references":["https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","https://github.com/pig-mesh/pig/blob/v4.1.1/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysUserController.java#L94-L102","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-through-4.1.1-missing-authorization-via-get-admin-user-details-id"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-111343","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-21T01:44:12.757138Z"}}}],"references":[{"url":"https://hackmd.io/@hieuPenguinnn/pig-mesh-user-details-byid-missing-authz-idor","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T01:44:35.077Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-15T21:43:35.878Z"}}},"related_cves":[{"value":"CVE-2026-111343","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a0abc11c-fa4f-4710-9709-7527c1d43813","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111343","advisory_id":"a0abc11c-fa4f-4710-9709-7527c1d43813","event_types":["advisory"],"published_at":"2026-10-25T12:26:22.123129+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-15T21:43:35.878+00:00","detail_url":"/events/45019"}]}},{"id":1691,"cve_ids":["CVE-2026-91995"],"payload":{"kind":"advisory","title":"pig before 4.1.0 Unverified Password Change via /register/password","summary":"pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.","evidence":"cve:CVE-2026-91995","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-91995","aliases":["CVE-2026-91995"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","lessThan":"4.1.0","versionType":"semver"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:34.732Z","provider":"cve","references":["https://github.com/geo-chen/oss/blob/main/pig.md","https://github.com/pig-mesh/pig/issues/1249","https://github.com/pig-mesh/pig/commit/ce958668f399110b97b3f1fcc5f517ff9bcfd535","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/service/impl/SysUserServiceImpl.java#L650-L669","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysRegisterController.java#L21-L53","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-before-4.1.0-unverified-password-change-via-register-password"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91995","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T17:15:18.219296Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T17:23:05.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:34.732Z"}}},"related_cves":[{"value":"CVE-2026-91995","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f062b3a-3833-4e32-8050-e3e70e731b4b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91995","advisory_id":"1f062b3a-3833-4e32-8050-e3e70e731b4b","event_types":["advisory"],"published_at":"2026-10-24T21:05:48.939551+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T11:35:50.06+00:00","detail_url":"/advisories/advisory%3A1f062b3a-3833-4e32-8050-e3e70e731b4b","group":{"id":"advisory:1f062b3a-3833-4e32-8050-e3e70e731b4b","revision":1,"primary_event_id":1675,"change":"published","superseded_by":[],"changed":{"id":1675,"cve_ids":["CVE-2026-91995"],"payload":{"kind":"advisory","title":"pig before 4.1.0 Unverified Password Change via /register/password","summary":"pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.","evidence":"cve:CVE-2026-91995","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-91995","aliases":["CVE-2026-91995"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","lessThan":"4.1.0","versionType":"semver"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:34.732Z","provider":"cve","references":["https://github.com/geo-chen/oss/blob/main/pig.md","https://github.com/pig-mesh/pig/issues/1249","https://github.com/pig-mesh/pig/commit/ce958668f399110b97b3f1fcc5f517ff9bcfd535","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/service/impl/SysUserServiceImpl.java#L650-L669","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysRegisterController.java#L21-L53","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-before-4.1.0-unverified-password-change-via-register-password"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91995","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T17:15:18.219296Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T17:23:05.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:34.732Z"}}},"related_cves":[{"value":"CVE-2026-91995","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f062b3a-3833-4e32-8050-e3e70e731b4b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91995","advisory_id":"1f062b3a-3833-4e32-8050-e3e70e731b4b","event_types":["advisory"],"published_at":"2026-10-24T21:05:48.939551+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T11:35:50.06+00:00","detail_url":"/events/1675"},"members":[{"id":1675,"cve_ids":["CVE-2026-91995"],"payload":{"kind":"advisory","title":"pig before 4.1.0 Unverified Password Change via /register/password","summary":"pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.","evidence":"cve:CVE-2026-91995","products":[{"name":{"value":"pig","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-91995","aliases":["CVE-2026-91995"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"repo":"https://github.com/pig-mesh/pig","vendor":"pig-mesh","product":"pig","versions":[{"status":"affected","version":"0","lessThan":"4.1.0","versionType":"semver"}],"packageURL":"pkg:github/pig-mesh/pig","defaultStatus":"unaffected"}],"modified":"2026-09-24T14:22:34.732Z","provider":"cve","references":["https://github.com/geo-chen/oss/blob/main/pig.md","https://github.com/pig-mesh/pig/issues/1249","https://github.com/pig-mesh/pig/commit/ce958668f399110b97b3f1fcc5f517ff9bcfd535","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/service/impl/SysUserServiceImpl.java#L650-L669","https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysRegisterController.java#L21-L53","https://github.com/pig-mesh/pig","https://www.vulncheck.com/advisories/pig-before-4.1.0-unverified-password-change-via-register-password"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-91995","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-18T17:15:18.219296Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T17:23:05.268Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-24T14:22:34.732Z"}}},"related_cves":[{"value":"CVE-2026-91995","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1f062b3a-3833-4e32-8050-e3e70e731b4b","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91995","advisory_id":"1f062b3a-3833-4e32-8050-e3e70e731b4b","event_types":["advisory"],"published_at":"2026-10-24T21:05:48.939551+00:00","technologies":["core-cve","pig"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-15T11:35:50.06+00:00","detail_url":"/events/1675"}]}}],"next_after":56351,"next_before":1691}