Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109080— SQL injection in Night Shift bulk license plate search allows cross-organization data access

Quick assessment

Affected
Flock Night Shift
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Flock 夜间轮班托管服务中的批量车牌搜索功能存在 SQL 注入漏洞，攻击者可通过构造恶意的车牌值，以认证用户身份读取其他客户组织的数据（包括车牌识别记录）。该漏洞仅允许读取数据，无法修改数据。Flock 通过内部安全审查发现此问题，并于 2026 年 8 月 12 日完成修复；客户无需采取任何行动。

CVSS 6.5 · Medium EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1115 · Clipboard Data

Affected Version Matrix 1

VendorProduct Version RangeStatus
Flock Night Shift ≤ 2026-08-12 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109080

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQL injection in Night Shift bulk license plate search allows cross-organization data access
Source: CVE Program / CVE List V5
Vulnerability Description
SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer organizations' data, including license plate recognition records, via a crafted license plate value. Data could not be modified. Flock identified the issue through internal security review and remediated it on 2026-08-12; no customer action is required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Flock Night Shift 0 ~ 2026-08-12 -

II. Public POCs for CVE-2026-109080

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109080

请登录查看更多情报信息。

Other References for CVE-2026-109080 (1)

IV. Related Vulnerabilities

Same weakness: CWE-89

V. Comments for CVE-2026-109080

No comments yet

Leave a comment