SQL Injection via MySQL Quote Method_CVE-2026-48188

{
    "lastseen": "",
    "description": "An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition\u00a0database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if\u00a0the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode.\n\nThis issue affects OTRS: \n\n  *  7.0.X\n  *  8.0.X\n  *  2023.X\n  *  2024.X\n  *  2025.X\n  *  2026.X before 2026.4.X\n  *  (OTRS)) Community Edition: 6.0.x\n\nProducts based on the ((OTRS)) Community Edition also very likely to be affected",
    "published": "2026-06-01T03:33:15.822Z",
    "modified": "2026-06-01T03:33:15.822Z",
    "type": "cve",
    "title": "SQL Injection via MySQL Quote Method",
    "source": "OTRS",
    "references": "https://otrs.com/release-notes/otrs-security-advisory-2026-02/",
    "id": "CVE-2026-48188",
    "bulletinFamily": "",
    "cwe": [
        "CWE-20"
    ],
    "cvelist": null,
    "sourceData": "OTRS AG OTRS 7.0.x\nOTRS AG OTRS 8.0.x\nOTRS AG OTRS 2023.x\nOTRS AG OTRS 2024.x\nOTRS AG OTRS 2025.x\nOTRS AG OTRS 2026.x\nOTRS AG ((OTRS)) Community Edition 6.x",
    "sourceHref": "",
    "cvss": {
        "score": 9.1,
        "severity": "CRITICAL",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "OTRS",
    "version": "7.0.x",
    "vendor": "OTRS AG",
    "ai_description": "SQL injection vulnerability in OTRS database layer module via MySQL quote method, allowing authentication bypass",
    "ai_severity": "Critical",
    "ai_vendor": "OTRS AG",
    "ai_product": "OTRS",
    "ai_version": "7.0.x, 8.0.x, 2023.x, 2024.x, 2025.x, 2026.x before 2026.4.x, ((OTRS)) Community Edition 6.0.x",
    "ai_score": 9.1
}