Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or cause denial-of-service against the analytics backend.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-56281](https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf) Capgo b... https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf #Vulnerability #CVE #ZeroDay
Post summary
The tweet announces disclosure of CVE-2026-56281 as a zero‑day vulnerability affecting Capgo, linking to the GitHub advisory for details.
🚨*CVE* CVE-2026-56281 Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated requ… https://www.cve.org/CVERecord?id=CVE-2026-56281 ----- Traducción: CVE-2026-56281 Cap… http://infoflow.cloud`
Post summary
The post announces a CVE‑identified SQL injection in Capgo, providing a link to the CVE record, but offers no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-56281 Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidated requ… https://www.cve.org/CVERecord?id=CVE-2026-56281
Post summary
The statement reveals a SQL injection flaw in Capgo's POST /private/admin_stats endpoint prior to version 12.128.2, providing technical details but no proof of exploitation or remediation.