CVE-2026-18719
Received Received - Intake

SQL Injection in sar2html 4.0.0 Search Component

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description
A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18719
EUVD
EUVD-2026-52554

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in cemtan sar2html 4.0.0, specifically in the sar2html.py file's Search component. An attacker can manipulate the Search argument to inject malicious SQL code, potentially accessing or modifying database contents.

Detection Guidance

Detecting this SQL injection vulnerability in cemtan sar2html 4.0.0 requires checking for unusual input patterns in the Search parameter of sar2html.py. Monitor web server logs for suspicious queries containing SQL syntax like ' OR 1=1 -- or similar payloads. Test the endpoint manually by appending crafted inputs to the Search argument.

Impact Analysis

The impact includes unauthorized data access, data manipulation, or database takeover. Since the exploit is public, attackers could remotely target systems using this software, leading to potential data breaches or service disruption.

Mitigation Strategies

Immediately update or patch sar2html to a version that fixes the SQL injection flaw. If no patch is available, disable or remove the software from your system. Implement input validation for the Search parameter to block SQL metacharacters. Use a web application firewall to filter malicious queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart