A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulatio…

A SQL injection vulnerability was identified in ESAFENET CDG up to version 20260615. The vulnerability exists in an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs, where manipulation of the 'keyid' argument leads to SQL injection. The attack can be performed remotely, and a public exploit is already available, increasing the risk of active exploitation. The vendor was contacted prior to disclosure but did not respond. This represents a critical remotely exploitable vulnerability in a document security/DLP product. The lack of vendor response and public exploit availability make this particularly concerning for organizations using this software.