CVE-2026-14751: SQL Injection in mjperpinosa stumasy Notes Controller

Technical summary

The vulnerability exists in the Notes_controller::search_scratch_data function within application/PHP/objects/notes/search_scratch_data.php. It stems from insufficient input validation and sanitization of the field_name argument before its use in a SQL query (CWE-89: SQL Injection; CWE-74: Improper Neutralization of Special Elements). The flaw permits an authenticated remote attacker to craft malicious SQL payloads that execute arbitrary queries against the application's database. The rolling-release model of the project means version tracking is not applicable to this codebase.

Business impact

This vulnerability exposes sensitive data stored in the application's database to unauthorized access and modification. Attackers with valid credentials—whether leaked, compromised, or obtained through social engineering—can extract confidential information, alter records, or degrade system reliability. The lack of vendor response increases operational risk for organizations relying on this software, as there is currently no confirmed remediation timeline.

Affected systems

mjperpinosa stumasy is affected up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Because this project operates on a rolling-release cycle, traditional version numbers are not assigned. Organizations using mjperpinosa stumasy should identify their current commit hash and verify it against the disclosed commit to determine exposure status.

Exploitability

The attack requires valid user authentication (CVSS PR:L rating), which moderates but does not eliminate risk. The exploit is network-accessible and requires no user interaction. Public disclosure of this vulnerability means exploit code is available, increasing the likelihood of opportunistic attacks against unpatched instances. Insider threats or compromised credentials represent realistic attack vectors.

Remediation

Update mjperpinosa stumasy to a commit after 327d1b0f2915ba79d7ef8ebb74553e987609d9be once the maintainers release a fix. Until then, compensating controls should be implemented: apply strict input validation and parameterized queries in the affected function, restrict database user permissions to the principle of least privilege, and monitor access logs for suspicious SQL patterns. Network-level controls (IP whitelisting, VPN-only access) can reduce remote attack surface.

Patch guidance

Monitor the project's repository and issue tracker for security updates addressing the field_name parameter in Notes_controller::search_scratch_data. Given the rolling-release model, patches will not be versioned; instead, pull the latest commit from the primary branch once the maintainers confirm the vulnerability is resolved. Test patches thoroughly in a non-production environment before deployment. Establish a process to track commits and verify you are running a patched version.

Detection guidance

Monitor database query logs for unusual SQL patterns in search operations, particularly those containing union statements, comment sequences (-- or /**/), or time-delay functions in the field_name parameter. Watch authentication logs for failed login attempts or privilege escalation attempts. Implement web application firewalls (WAF) rules to detect and block common SQL injection payloads in search parameters. Regular code review of the Notes_controller::search_scratch_data function can identify exploitation attempts in logs or database query patterns.

Why prioritize this

CVSS 6.3 (MEDIUM) reflects a confidentiality, integrity, and availability risk moderated by the requirement for authentication. However, public exploit availability and lack of vendor response elevate practical priority. Organizations with mjperpinosa stumasy in production or exposed to untrusted users should prioritize assessment and remediation planning over lower-risk vulnerabilities, especially if database contents are sensitive.

Risk score, explained

The CVSS 3.1 score of 6.3 accounts for: network accessibility (AV:N, no special access required); low attack complexity (AC:L); requirement for low-level privileges (PR:L, valid user account); no user interaction (UI:N); and impact limited to the affected system (S:U). The score assumes a single user account, but in scenarios where credentials are shared or compromised, effective impact could be higher. The lack of KEV (Known Exploited Vulnerability) listing does not reduce real-world risk given public exploit availability.

Frequently asked questions