org.apache.sis.storage/sis-sqlstore vulnerabilities

Latest org.apache.sis.storage/sis-sqlstore CVEs

Newest publication first

1. CVE-2026-110733 Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store

   Published 2026-10-26

   Medium·CVSS 5.4 EPSS 0.32%

   Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue affects the sql-storage module of Apache SIS fro...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.