GCVE - cpe:2.3:a:manticoresoftware:manticore

Approved changes feed: RSS · Atom

cpe:2.3:a:manticoresoftware:manticore_search:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Manticoresoftware (`a77867a5-5960-5565-a72a-41d1d77f751c`)
Product	Manticore Search (`2aaae0f5-8c06-507c-8f75-2b32ace59f70`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92796`	vulnerable	2026-10-13 12:28:53.745750	Manticore Search 27.0.0 before 28.4.4 Multi-Statement Authorization Bypass HIGH (8.8) Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery. Published: 2026-09-16T20:32:50.419Z Updated: 2026-09-21T15:43:07.203Z Open on db.gcve.eu Reference links https://github.com/geo-chen/oss/blob/main/manticoresearch.md https://github.com/manticoresoftware/manticoresearch/issues/4706 https://github.com/manticoresoftware/manticoresearch/blob/release-28.4.4/src/auth/auth_proto_mysql.cpp#L408-L418 https://github.com/manticoresoftware/manticoresearch https://www.vulncheck.com/advisories/manticore-search-27.0.0-before-28.4.4-multi-statement-authorization-bypass	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.