CVE-2026-37505

Katalog CVE

CVSS 4.9 · Medium EPSS 0,42%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada v2board. Skor CVSS 3.1 4.9 (Medium) menurut NVD.

Deskripsi (NVD)

SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.

Rincian

Terbit di NVD

1 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 advisory pihak ketiga
• https://github.com/v2board/v2board product