CVE-2026-5577 Details
Description
A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquemachine_app.py of the component details Endpoint. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
A SQL injection vulnerability has been identified in the Song-Li cross_browser application, specifically in the details endpoint of the legacy MySQL-backed Flask component. The vulnerability arises because the application directly concatenates user-supplied ID values from JSON request bodies into SQL SELECT statements without proper parameterization or escaping. This flaw allows remote attackers to manipulate the SQL query and access unintended database records. In some MySQL configurations, it could also enable broader data exfiltration or facilitate blind SQL injection techniques.
Do not deploy the legacy Flask application with MySQL backend. If the application is already running, remove or disable the vulnerable endpoint. Consider using the non-SQL experimental backend or a patched version that implements parameterized queries. If the legacy backend must be used, restrict access to the endpoint to trusted users and networks, and monitor for signs of exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wing3e/public_exp/issues/24 | [email protected] | ExploitMitigationThird Party Advisory |
| https://vuldb.com/submit/783502 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/355347 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/355347/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| songli cross browser fingerprinting | <= 2022-01-17 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 5, 2026 | New CVE Received | [email protected] |