CVE-2026-19354Disclosure

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity News@XQOPTRX46d
Disclosure
💉 New SQL injection discovered in OPMS CVE-2026-19354 affects the OPMS project. The vulnerability is located in message.go, where manipulation of an ids value used in an SQL IN clause can result in SQL injection. 📅 Disclosed: August 8. 🔎 Source: CVE/Vulnerability feed via YANAC. #SQLInjection #CVE #AppSec #CyberSecurity
Post summary
The post announces the discovery of CVE‑2026‑19354, detailing a SQL injection flaw in OPMS, but does not provide a PoC, exploit, patch, or evidence of active exploitation.
0000046
34 followersView on X

Explore more

Back to dashboard