Description
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tenable | Security Center | < 6.8.0 | 6.8.0 |