CVE-2026-28443

MediumPublic PoC

Published: 05 March 2026

Published

05 March 2026

Modified

17 March 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0034 25.8th percentile

Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-28443 is a medium-severity SQL Injection (CWE-89) vulnerability in Openreplay Openreplay. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-28443 is a SQL injection vulnerability (CWE-89) affecting OpenReplay, a self-hosted session replay suite. The flaw exists in the POST /{projectId}/cards/search endpoint prior to version 1.20.0, specifically within the sort.field parameter. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.

An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation allows arbitrary SQL query execution, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data access, modification, or deletion within the affected OpenReplay database.

The issue has been addressed in OpenReplay version 1.20.0. Security practitioners should upgrade to this patched version immediately. Additional details are available in the GitHub Security Advisory at https://github.com/openreplay/openreplay/security/advisories/GHSA-q6gf-3qg3-pww5.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9880

Vulnerability details

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes an unauthenticated SQL injection in a publicly accessible web endpoint of OpenReplay, directly enabling remote exploitation of a public-facing application with no user interaction required.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0