CVE Alert: CVE-2026-94144 – drogonframework

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early this disclosure but did not respond in any way.

**Risk verdict:** High practical risk for internet-facing applications, warranting urgent remediation because exploitation is straightforward and a working proof of concept is publicly available, although KEV and EPSS prioritisation data are not present.

**Why this matters:** Successful exploitation could expose or alter application data, disrupt database-backed services, and potentially retrieve credentials or sensitive records accessible to the application account. Public exploitability reduces the skill and effort required for opportunistic attacks, particularly against APIs that pass user-controlled filtering criteria to the ORM.

**Most likely attack path:** A remote attacker can submit crafted filter input to an exposed endpoint without authentication or user interaction; the low-complexity path does not require special access. Scope remains within the vulnerable application’s authority, but the attacker may still read, modify or delete data permitted to its database identity, with indirect lateral-movement risk if secrets or privileged records are exposed.

**Who is most exposed:** Internet-facing services built with this framework’s ORM, especially , reporting, administration and API endpoints accepting query parameters or JSON filters. Internal applications remain at risk where untrusted users, partners or compromised hosts can reach them.

Alert on SQL metacharacters, markers and unusual Boolean/time-delay expressions in filter inputs.

Review database logs for anomalous query shapes, errors, enumeration or bulk extraction.

Correlate API requests with unexpected data-volume spikes or privileged-table access.

Hunt for exploit-like requests matching the published proof of concept.

Mitigation and prioritisation:

Identify and deploy the vendor-maintained fixed release; no corrected release is supplied here, so confirm its availability before change approval.

Until patched, parameterise queries, strictly allow-list filter fields and restrict database permissions.

Add WAF/API validation rules and limit exposure to trusted networks where feasible.

Test affected and reporting functions after upgrade; treat public exploitability as an expedited change.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.