Executive brief
Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API in github.com/daptin/daptin
Affected products
- Go github.com/daptin/daptin
Junglewise Threat Intelligence
CVE-2026-41422: GO-2026-5640 - Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API in github.com/daptin/daptin
CVE-2026-41422 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/daptin/daptin (Go). Vendors: Go.
Related threats
- GO-2026-5555 - Daptin fuzzy search injects unvalidated column name into raw SQL in github.com/daptin/daptin
- GO-2026-5285 - Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin
- GO-2026-4991 - Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change in github.com/daptin/daptin
- Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change
- Daptin has Unauthenticated Path Traversal and Zip Slip