Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110911

Quick assessment

Affected
Wheels Wheels
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Wheels 1.1.8 至 4.1.1 版本存在 SQL 注入漏洞。当调用者提供的带引号的值被动态查找器（例如 findOneByEmail）、查询生成器的 where(property, value) 和 where(property, operator, value) 方法、字符串/UUID 键查找路径（如 findByKey、updateByKey、deleteByKey 和 findOrCreateBy...）以及 validatesUniquenessOf 验证再次解析为 SQL 时，便会触发该漏洞。问

CVSS 9.8 · Critical EPSS 0.30% · P21

Affected Version Matrix 1

VendorProduct Version RangeStatus
Wheels Wheels 1.1.8< 4.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110911

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Wheels Wheels 1.1.8 ~ 4.1.2 -

II. Public POCs for CVE-2026-110911

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110911

请登录查看更多情报信息。

Other References for CVE-2026-110911 (1)

IV. Related Vulnerabilities

Same product: Wheels
Same vendor: Wheels
Same weakness: CWE-89

V. Comments for CVE-2026-110911

No comments yet

Leave a comment