CVE-2026-111634
Received Received - Intake

Helical Insight SQL Injection via Report Parameter

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to read unexposed tables and modify data in the report's data source.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111634
EUVD
EUVD-2026-103056

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
helicalinsight helicalinsight 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Helical Insight through version 7.0.0 has a SQL injection vulnerability in the /executeDatasource endpoint. Authenticated users can inject malicious SQL queries through unescaped report parameters. The flaw bypasses the SqlDetect guard, allowing attackers to read unexposed tables or modify data in the report's data source.

Detection Guidance

To detect this SQL injection vulnerability in Helical Insight 7.0.0 or earlier, monitor HTTP requests to the /executeDatasource endpoint for unescaped parameter values, particularly numeric or string placeholders. Check for SQL-like payloads in parameters such as name or id. Review logs for suspicious query patterns or errors indicating SQL syntax issues.

Impact Analysis

This vulnerability allows authenticated attackers to execute arbitrary SQL queries. They can read sensitive data from unexposed tables, modify or delete data in the database, and potentially escalate privileges. The impact includes data breaches, unauthorized data manipulation, and compromise of the application's data integrity.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized data access or modification. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Exploitation could result in data breaches, triggering legal penalties, fines, and reputational damage for organizations.

Mitigation Strategies

Immediately upgrade to a patched version of Helical Insight beyond 7.0.0. Implement strict input validation for all parameters sent to /executeDatasource, especially numeric and string values. Disable or restrict access to the /executeDatasource endpoint for low-privilege users until patched. Review and enforce parameterized queries instead of direct string concatenation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart