Back to overview

CVE-2026-8659

MEDIUM
6.0
CVSS 3.1
Description
OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.

Metadata

CVE ID
CVE-2026-8659
State
PUBLISHED
Assigner
rapid7
Reserved
2026-05-15 06:28 UTC
Published
2026-06-25 00:07 UTC
Last updated
2026-06-25 00:07 UTC
Primary CWE
CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product
Rapid7 / InsightConnect SQLmap Plugin
Sources
cve.org  ·  NVD

Severity & Metrics

6.0 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
Affected products (1)
VendorProductPlatformVersions
Rapid7 InsightConnect SQLmap Plugin Linux 0 < 2.0.1, 2.0.1
Weakness (CWE)
CWESourceDescription
CWE-78 cna CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.0 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
References (1)
Back to overview