CVE-2026-58492

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.

• CWE-89

• https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df
• https://github.com/getgrav/grav-plugin-database/releases/tag/1.2.0
• https://github.com/getgrav/grav/security/advisories/GHSA-8jxg-4pw9-xcwf

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58486HedgeDoc is an open source, real-time, collaborative, markdo…8.3
• CVE-2026-58487HedgeDoc is an open source, real-time, collaborative, markdo…5.1
• CVE-2026-58488HedgeDoc is an open source, real-time, collaborative, markdo…6.9
• CVE-2026-58489HedgeDoc is an open source, real-time collaborative markdown…6.8
• CVE-2026-5849A vulnerability was determined in Tenda i12 1.0.0.11(3862). …9.8
• CVE-2026-58491Warpgate is an open source SSH, HTTPS and MySQL bastion host…9.3
• CVE-2026-58493grav-plugin-database is the database plugin for Grav CMS. Pr…5.1
• CVE-2026-58494Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.…6.5
• CVE-2026-58499EverOS is a memory runtime for agents. Prior to 1.0.1, EverO…8.2
• CVE-2026-5850A vulnerability was identified in Totolink A7100RU 7.4cu.231…9.8
• CVE-2026-58500MCP Appium is an MCP server that provides AI assistants with…8.2
• CVE-2026-58501Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Setti…5.9