CVE-2026-33350 | aces Loris up to 27.0.2/28.0.0 sql injection

VDB-356351 · CVE-2026-33350 · GCVE-0-2026-33350 ACES LORIS UP TO 27.0.2/28.0.0 SQL INJECTION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 7.2 $0-$5k 0.75+ Summaryinfo A vulnerability identified as critical has been detected in aces Loris up to 27.0.2/28.0.0. The affected element is an unknown function. The manipulation leads to sql injection. This vulnerability is documented as CVE-2026-33350. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component. Detailsinfo A vulnerability was found in aces Loris up to 27.0.2/28.0.0 and classified as critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-33350 since 03/18/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK. Upgrading to version 27.0.3 or 28.0.1 eliminates this vulnerability. Productinfo Vendor aces Name Loris Version 27.0.0 27.0.1 27.0.2 28.0 Website Product: https://github.com/aces/Loris/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 7.4 VulDB Meta Temp Score: 7.2 VulDB Base Score: 7.3 VulDB Temp Score: 7.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 7.5 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Sql injection CWE: CWE-89 / CWE-74 / CWE-707 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Loris 27.0.3/28.0.1 Timelineinfo 03/18/2026 CVE reserved 04/08/2026 +20 days Advisory disclosed 04/08/2026 +0 days VulDB entry created 04/08/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: github.com Status: Confirmed CVE: CVE-2026-33350 (🔒) GCVE (CVE): GCVE-0-2026-33350 GCVE (VulDB): GCVE-100-356351 Entryinfo Created: 04/08/2026 21:00 Changes: 04/08/2026 21:00 (63) Complete: 🔍 Cache ID: 99:DE1:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸