CVE-2026-54185
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Subscriber SQL Injection vulnerability in Cornerstone versions below 7.8.8 allows attackers to execute malicious SQL queries.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to database information, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to Cornerstone version 7.8.8 or later to mitigate this vulnerability.
Other vulnerabilities in Cornerstone
See all- CVE-2026-49113High
In Cornerstone versions below 7.8.8, there is a vulnerability allowing arbitrary code execution by a subscriber.
- CVE-2025-63072Medium
Stored XSS vulnerability in Cornerstone plugin by THEMECO. Improper input neutralization during web page generation allows persistent script injection.
Original NVD description (English source)
Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS