CVE-2026-0242

Severity CVSS v4.0:

MEDIUM

Type:

CWE-89 SQL Injection

Publication date:

13/05/2026

Last modified:

14/05/2026

Description

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.

Impact

Vector 4.0

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:Y/R:U/V:C/RE:M/U:Amber CVSS v4.0 Severity and Metrics:

Base Score: 6.10 MEDIUM
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:Y/R:U/V:C/RE:M/U:Amber

Attack Vector (AV): Adjacent
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): Low
User Interaction (UI): None
Confidentiality (VC): High
Integrity (VI): High
Availability (VA): High
Confidentiality (SC): Low
Integrity (SI): Low
Availability (SA): None
Automatable (AU): Yes
Recovery (R): User
Value Density (V): Concentrated
Vulnerability Response Effort (RE): Moderate
Provider Urgency (U): Amber
Exploit Maturity (E): Unreported

Base Score 4.0

6.10

Severity 4.0

MEDIUM

References to Advisories, Solutions, and Tools

https://security.paloaltonetworks.com/CVE-2026-0242