Executive brief
Daptin fuzzy search injects unvalidated column name into raw SQL in github.com/daptin/daptin
Affected products
- Go github.com/daptin/daptin
Junglewise Threat Intelligence
CVE-2026-44349: GO-2026-5555 - Daptin fuzzy search injects unvalidated column name into raw SQL in github.com/daptin/daptin
CVE-2026-44349 · Severity: medium · CVSS 4 · Published 2026-06-25
Technologies: github.com/daptin/daptin (Go). Vendors: Go.
Related threats
- GO-2026-5640 - Daptin: SQL injection via unvalidated goqu.L() calls in aggregate API in github.com/daptin/daptin
- GO-2026-5285 - Daptin has Unauthenticated Path Traversal and Zip Slip in github.com/daptin/daptin
- GO-2026-4991 - Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change in github.com/daptin/daptin
- Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change
- Daptin has Unauthenticated Path Traversal and Zip Slip