A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Pr

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ui unifi protectbefore 7.1.83

Versions reported by the vendor

Affected version ranges reported by the assigning authority (hackerone). Independent of NVD's CPE analysis and usually ahead of it.

• Ubiquiti Inc UniFi Protect Application

  • before 7.1.83affected · semver

Other highest-scoring records for the same primary product.

• CVE-2026-55115A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Applicat
  39Monitor
• CVE-2026-54408A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by
  39Monitor
• CVE-2021-22943A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network
  38Monitor
• CVE-2026-21633A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery p
  35Monitor
• CVE-2021-22957A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor
  35Monitor
• CVE-2026-54407A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to by
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = '" + owner + "'"4);

1const owner = req.query.owner;2const rows = await db.query(3  "SELECT * FROM files WHERE owner = $1",4  [owner]5);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.