Medium severity · published Oct 14, 2026
CVE-2026-110614
Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
citrus · Yiuman
through 0.15.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-110614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-110614
third-party-advisory
https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli
technical-description
https://github.com/Yiuman/citrus/blob/0.15.0/citrus-support/src/main/java/com/github/yiuman/citrus/support/crud/query/QueryHelper.java#L123-L129
product
https://github.com/Yiuman/citrus
third-party-advisory
https://www.vulncheck.com/advisories/yiuman-citrus-through-0.15.0-order-by-sql-injection-via-sortby-parameter