CVE-2026-108569
Status: DeferredLow (2.1)—
Severity2.1Low · CVSS 4.0
Exploitation probability0.30 %higher than 22% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS
- Base score
- 2.1
- Version
- 4.0
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.30 %
- Percentile among all scored CVEs
- 22
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1210Exploitation of Remote Serviceslateral movement75 % - Primary impact
T1005Data from Local Systemcollection80 % - Secondary impact
T1565.001Stored Data Manipulationimpact70 %
SQL injection en función accesible remotamente (AV:N, PR:L) que requiere privilegios autenticados. Permite lectura de datos (T1005) y manipulación de registros (T1565.001). CWE-89 confirma inyección SQL.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-74, CWE-89
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-108569",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-108569",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-14T02:50:16.181678Z"
}
}
],
"cvssMetricV2": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"version": "2.0",
"baseScore": 6.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 3.4,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 2.1,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "LOW",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "PROOF_OF_CONCEPT",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "cna@vuldb.com",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:furion:.net_framework:*:*:*:*:*:*:*:*"
],
"vendor": "Furion",
"product": ".NET Framework",
"versions": [
{
"status": "affected",
"version": "4.9.9.0"
},
{
"status": "affected",
"version": "4.9.9.1"
},
{
"status": "affected",
"version": "4.9.9.2"
},
{
"status": "affected",
"version": "4.9.9.3"
},
{
"status": "affected",
"version": "4.9.9.4"
},
{
"status": "affected",
"version": "4.9.9.5"
},
{
"status": "affected",
"version": "4.9.9.6"
},
{
"status": "affected",
"version": "4.9.9.7"
},
{
"status": "affected",
"version": "4.9.9.8"
},
{
"status": "affected",
"version": "4.9.9.9"
},
{
"status": "affected",
"version": "4.9.9.10"
},
{
"status": "affected",
"version": "4.9.9.11"
},
{
"status": "affected",
"version": "4.9.9.12"
},
{
"status": "affected",
"version": "4.9.9.13"
},
{
"status": "affected",
"version": "4.9.9.14"
},
{
"status": "affected",
"version": "4.9.9.15"
},
{
"status": "affected",
"version": "4.9.9.16"
},
{
"status": "affected",
"version": "4.9.9.17"
},
{
"status": "affected",
"version": "4.9.9.18"
},
{
"status": "affected",
"version": "4.9.9.19"
},
{
"status": "affected",
"version": "4.9.9.20"
},
{
"status": "affected",
"version": "4.9.9.21"
},
{
"status": "affected",
"version": "4.9.9.22"
},
{
"status": "affected",
"version": "4.9.9.23"
},
{
"status": "affected",
"version": "4.9.9.24"
},
{
"status": "affected",
"version": "4.9.9.25"
},
{
"status": "affected",
"version": "4.9.9.26"
},
{
"status": "affected",
"version": "4.9.9.27"
},
{
"status": "affected",
"version": "4.9.9.28"
},
{
"status": "affected",
"version": "4.9.9.29"
},
{
"status": "affected",
"version": "4.9.9.30"
},
{
"status": "affected",
"version": "4.9.9.31"
},
{
"status": "affected",
"version": "4.9.9.32"
},
{
"status": "affected",
"version": "4.9.9.33"
},
{
"status": "affected",
"version": "4.9.9.34"
},
{
"status": "affected",
"version": "4.9.9.35"
},
{
"status": "affected",
"version": "4.9.9.36"
},
{
"status": "affected",
"version": "4.9.9.37"
},
{
"status": "affected",
"version": "4.9.9.38"
},
{
"status": "affected",
"version": "4.9.9.39"
},
{
"status": "affected",
"version": "4.9.9.40"
},
{
"status": "affected",
"version": "4.9.9.41"
},
{
"status": "affected",
"version": "4.9.9.42"
},
{
"status": "affected",
"version": "4.9.9.43"
},
{
"status": "affected",
"version": "4.9.9.44"
},
{
"status": "affected",
"version": "4.9.9.45"
},
{
"status": "affected",
"version": "4.9.9.46"
},
{
"status": "affected",
"version": "4.9.9.47"
},
{
"status": "affected",
"version": "4.9.9.48"
},
{
"status": "affected",
"version": "4.9.9.49"
},
{
"status": "affected",
"version": "4.9.9.50"
},
{
"status": "affected",
"version": "4.9.9.51"
},
{
"status": "affected",
"version": "4.9.9.52"
},
{
"status": "affected",
"version": "4.9.9.53"
},
{
"status": "affected",
"version": "4.9.9.54"
},
{
"status": "affected",
"version": "4.9.9.55"
},
{
"status": "affected",
"version": "4.9.9.56"
},
{
"status": "affected",
"version": "4.9.9.57"
},
{
"status": "affected",
"version": "4.9.9.58"
},
{
"status": "affected",
"version": "4.9.9.59"
},
{
"status": "affected",
"version": "4.9.9.60"
},
{
"status": "affected",
"version": "4.9.9.61"
},
{
"status": "affected",
"version": "4.9.9.62"
},
{
"status": "affected",
"version": "4.9.9.63"
},
{
"status": "affected",
"version": "4.9.9.64"
},
{
"status": "affected",
"version": "4.9.9.65"
},
{
"status": "affected",
"version": "4.9.9.66"
},
{
"status": "affected",
"version": "4.9.9.67"
},
{
"status": "affected",
"version": "4.9.9.68"
},
{
"status": "affected",
"version": "4.9.9.69"
},
{
"status": "affected",
"version": "4.9.9.70"
},
{
"status": "affected",
"version": "4.9.9.71"
},
{
"status": "affected",
"version": "4.9.9.72"
},
{
"status": "affected",
"version": "4.9.9.73"
},
{
"status": "affected",
"version": "4.9.9.74"
},
{
"status": "affected",
"version": "4.9.9.75"
},
{
"status": "affected",
"version": "4.9.9.76"
},
{
"status": "affected",
"version": "4.9.9.77"
},
{
"status": "affected",
"version": "4.9.9.78"
},
{
"status": "affected",
"version": "4.9.9.79"
},
{
"status": "affected",
"version": "4.9.9.80"
},
{
"status": "affected",
"version": "4.9.9.81"
},
{
"status": "affected",
"version": "4.9.9.82"
},
{
"status": "affected",
"version": "4.9.9.83"
},
{
"status": "affected",
"version": "4.9.9.84"
},
{
"status": "affected",
"version": "4.9.9.85"
},
{
"status": "affected",
"version": "4.9.9.86"
},
{
"status": "affected",
"version": "4.9.9.87"
},
{
"status": "affected",
"version": "4.9.9.88"
},
{
"status": "affected",
"version": "4.9.9.89"
},
{
"status": "affected",
"version": "4.9.9.90"
},
{
"status": "affected",
"version": "4.9.9.91"
},
{
"status": "affected",
"version": "4.9.9.92"
}
]
}
]
}
],
"published": "2026-10-11T11:16:58.727",
"references": [
{
"url": "https://vuldb.com/cve/CVE-2026-108569",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/submit/954713",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/vuln/416226",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/vuln/416226/cti",
"source": "cna@vuldb.com"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "cna@vuldb.com",
"description": [
{
"lang": "en",
"value": "CWE-74"
},
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"lastModified": "2026-10-14T03:17:16.747",
"sourceIdentifier": "cna@vuldb.com"
}