High severity · published Sep 21, 2026
CVE-2026-94143
drogonframework drogon ORM Mapper Mapper.h orderBy sql injection
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
drogon · drogonframework
1.9.0; 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; +8 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-94143
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-94143
gist.github.com
https://gist.github.com/2H-K/33f46c954fd3ed16b32eeddd598f90cf
github.com
https://github.com/drogonframework/drogon/
github.com
https://github.com/drogonframework/drogon/issues/2575
vuldb.com
https://vuldb.com/cve/CVE-2026-94143
vuldb.com
https://vuldb.com/submit/893923
vuldb.com
https://vuldb.com/vuln/408058
More from drogon
8.8
CVE-2022-25297
Arbitrary File Write
7.5
CVE-2021-35397
A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to arbitrarily read files
7.3
CVE-2026-94144
drogonframework drogon ORM Criteria.cc makeCriteria sql injection
6.1
CVE-2023-26137
All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the addHeader and…
5.3
CVE-2026-105144
Drogon Static File Router StaticFileRouter.cc route path traversal