← Database

CVE-2026-46446

HIGH CVSS: 7.1 Published: 2026-05-14 Modified: 2026-06-17

Description

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.

Affected Platforms

Unknown

Weakness Type

CWE-89

References