CVE-2026-28443

Published March 5th, 2026

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0.

openreplay/openreplay

Session replay, cobrowsing and product analytics you can self-host. Best for reproducing issues and iterating on your product.

GitHub

12.1K