VulnSocial

CVE-2026-52887General

MEDIUMCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestMsgReceiveTimestamp][$lt] value was inserted into a Sequelize.literal() template string without escaping or parameter binding, allowing a signed-up authenticated user to run stacked PostgreSQL statements and potentially execute commands with COPY ... TO PROGRAM. This vulnerability is fixed in 2.0.61.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 6 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • General: 2 classified signals
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 2 mentions (2026-07-15); latest day: 2
  • 6 total mentions across 4 days

Deep dive

Activity timeline6 mentions / 4d
01122Mentions · 2026-07-15: 2Mentions · 2026-08-01: 1Mentions · 2026-08-04: 1Mentions · 2026-08-05: 2PoC Mentioned / Linked · 2026-08-05: 1Exploit Tool / Code · 2026-08-05: 1Patch / Workaround · 2026-07-15: 1Patch / Workaround · 2026-08-01: 1Technical Details · 2026-08-01: 1Technical Details · 2026-08-04: 1Technical Details · 2026-08-05: 107-1508-0108-0408-05
Signal classification4 categories
General
233.3%
Patch
233.3%
Disclosure
116.7%
Exploit
116.7%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-152
General1Patch1
2026-08-011
Patch1
2026-08-041
Disclosure1
2026-08-052
Exploit1General1
Full discourse6 posts
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Critical Exploits disclosed today: EGE-GH-nWj2Sy0 ( CVE-2026-42826 ) EGE-GH-FLy7Zaa ( CVE-2025-71338 ) EGE-GH-lPbsTBU ( CVE-2026-52887 ) EGE-GH-KAmy9Px ( CVE-2026-15409 ) EGE-GH-3TfhoOr ( CVE-2026-69083 ) ..🧵👇

    Post summary

    The post simply lists several CVE identifiers as critical exploits disclosed today, offering no additional insights or details.

    1000163
    29 followersView on X
  • ExploitGrid@exploitgrid
    Exploit

    [EXPLOIT] EGE-GH-lPbsTBU [CRITICAL/PoC] Linked: CVE-2026-52887 CVE-2026-52887-NocoBase-SQLi-RCE 🔗 https://exploitgrid.net/exploits/7264b92c-7be2-4068-bbb7-c058ca2899a7

    Post summary

    This post announces a critical exploit for CVE-2026-52887 on NocoBase, providing a PoC and functional code that demonstrates SQL injection leading to remote code execution.

    1000088
    29 followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-52887 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notificati… https://www.cve.org/CVERecord?id=CVE-2026-52887 ----- Traducción: CVE-2026-52887 Noc… http://infoflow.cloud`

    Post summary

    The post merely notes CVE‑2026‑52887 applies to NocoBase versions before 2.0.61, providing no technical, exploit, or patch details.

    0001042
    92 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-52887 NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notificati… https://www.cve.org/CVERecord?id=CVE-2026-52887

    Post summary

    This snippet references CVE‑2026‑52887 in NocoBase and notes that the issue was fixed in version 2.0.61, but provides no PoC, exploit, or technical details.

    00010631
    57.8K followersView on X
  • LibTracker@libtracker_io
    Disclosure

    CVE-2026-52887 : SQLi critique dans un plugin npm NocoBase, RCE superuser PostgreSQL (advisory GitHub). Exposés ? #CVE #SupplyChain

    Post summary

    A GitHub advisory notes CVE‑2026‑52887 as a critical SQLi leading to RCE in the NocoBase npm plugin, but no PoC, exploitation evidence, or patch details are supplied.

    0000055
    1 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    CVE-2026-52887: Critical SQL injection (CVSS 10) in NocoBase 💉 The `latestMsgReceiveTimestamp` field in `/api/myInAppChannels:list` splices unsanitized input into a raw Sequelize literal. No auth required. Patch now. #cybersecurity #ciso #vulnerabilities https://secalerts.co/vulnerability/GHSA-p849-8hwh-84j9?utm_campaign=x https://t.co/u5iWyX5mwG

    Post summary

    CVE-2026-52887 is a critical SQL injection in NocoBase’s API endpoint with no authentication, requiring an immediate patch.

    00000134
    871 followersView on X

Explore more

Back to dashboard