CVE-2026-55721
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
SQL Injection in StoneFly Storage Concentrator
Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password hashes, and stored secret keys.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Storage Concentrator
- Vendor
- StoneFly
- Product
- Storage Concentrator
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 8.0.4.22 | Unavailable | None listed |
| 8.0.4.29 | unaffected | Unavailable | Unavailable | Unavailable | None listed |
Storage Concentrator Virtual Machine
- Vendor
- StoneFly
- Product
- Storage Concentrator Virtual Machine
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | custom | 8.0.4.22 | Unavailable | None listed |
| 8.0.4.29 | unaffected | Unavailable | Unavailable | Unavailable | None listed |