SQL Injection in Daptin

CVE-2026-44349

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu…

Vulnerability class: SQL Injection

EPSS: 0.003 (22.5th percentile) — read the EPSS interpretation.