| Package | Affected versions | Patched versions |
|---|---|---|
| kestra | ≥ 1.1.0, < 1.3.7< 1.0.35 | 1.3.71.0.35 |
Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization. As a result, attackers can inject arbitrary SQL expressions into the database query.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free