CVE-2026-42740
Deferred Deferred - Pending Action

Blind SQL Injection in Tainacan Plugin

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: Patchstack

Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-27
Last Modified
2026-05-27
Generated
2026-07-06
AI Q&A
2026-05-28
EPSS Evaluated
2026-07-05
NVD
CVE-2026-42740
EUVD
EUVD-2026-32192

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tainacan tainacan to 1.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The vulnerability is a Blind SQL Injection in Tainacan versions up to 1.0.3, which allows an attacker to extract sensitive information from the database without authorization.

Such unauthorized data access can lead to breaches of confidentiality and data integrity, potentially resulting in violations of data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information.

Therefore, this vulnerability could negatively impact compliance with these standards by exposing protected data to attackers.

Executive Summary

This vulnerability is an SQL Injection issue in the Tainacan software, specifically versions up to 1.0.3. It involves improper neutralization of special elements used in SQL commands, allowing an attacker to perform Blind SQL Injection attacks.

Impact Analysis

The vulnerability has a high severity score (CVSS 9.3) and can allow an attacker to execute unauthorized SQL commands remotely without any privileges or user interaction. This can lead to high confidentiality impact by exposing sensitive data and a low availability impact by potentially disrupting the service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart