CVE-2026-108100 — HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/loc…
Published: 2026-10-09 · CVSS: 7.1 · CVSS 4.0
HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7