high7.1
CVE-2026-46446
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection.
Impact
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| SOGo | SOGo | before 5.12.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.