CVE-2026-124041
Received Received - Intake

Remote SQL Injection in Catalis/Patriot Properties WebPro 5.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description
Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-124041
EUVD
EUVD-2026-125590

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Catalis WebPro 5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-124041 is a vulnerability in Catalis/Patriot Properties WebPro 5.0 that allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database. This can lead to the exfiltration of sensitive property and taxpayer information.

Impact Analysis

This vulnerability can allow attackers to access and steal sensitive data such as property details and taxpayer information without needing authentication. This could result in privacy breaches, financial loss, or identity theft for affected individuals.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other privacy regulations due to unauthorized access and exfiltration of sensitive personal and taxpayer data. Organizations may face legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately restrict network access to the WebPro 5.0 application to trusted IPs only. Disable any public-facing endpoints if possible. Review and update firewall rules to block unauthorized SQL query attempts. Ensure all database connections are authenticated and encrypted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124041. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...