CVE-2026-2093

High

Published: 10 February 2026

Published

10 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0046 36.5th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-2093 is a high-severity SQL Injection (CWE-89) vulnerability in Org (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-2093 is a SQL injection vulnerability (CWE-89) in Docpedia, a product developed by Flowring. It allows unauthenticated remote attackers to inject arbitrary SQL commands, enabling them to read database contents. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact over the network with low attack complexity and no privileges or user interaction required.

Unauthenticated remote attackers can exploit this vulnerability by sending malicious SQL payloads to affected Docpedia instances. Successful exploitation grants read access to sensitive database contents, potentially exposing user data, credentials, or other confidential information stored in the backend database.

Mitigation details are provided in advisories from TWCERT/CC, available at https://www.twcert.org.tw/en/cp-139-10698-1ab75-2.html and https://www.twcert.org.tw/tw/cp-132-10697-6a30b-1.html. The vulnerability was published on 2026-02-10.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-6733

Vulnerability details

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote SQL injection in a public-facing web application (Docpedia) matches T1190 Exploit Public-Facing Application; enables initial access and database data exposure.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0