Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110614Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter

Medium 6.5

In plain English

A medium-severity SQL injection in citrus from Yiuman. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful to append unvalidated SQL to the ORDER BY clause and extract database contents using boolean- or time-based blind techniques.

Affected products (as reported)

Vendor	Product	Versions
Yiuman	citrus	0 – through 0.15.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/citrus-generic-query-orderby-sqli third-party-advisory
https://github.com/Yiuman/citrus/blob/0.15.0/citrus-support/src/main/java/com/github/yiuman/citrus/support/crud/query/QueryHelper.java#L123-L129 technical-description
https://github.com/Yiuman/citrus product
VulnCheck Advisory: Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter third-party-advisory