CVE-2026-111669
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by
CVSS
6.5
Medium
EPSS
0.3%
p26
KEV
—
Exploit Today
8
0-100
Published: Oct 16, 2026 · Last modified: Oct 16, 2026 · CWE-89
0.3%EPSS · 30 days0.3%
2026-10-172026-10-20
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
- gitee.comhttps://gitee.com/izory/ZrAdminNetCore/tags
- github.comhttps://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Admin.WebApi/Controllers/System/SysUserController.cs#L47-L52
- github.comhttps://github.com/izhaorui/Zr.Admin.NET/blob/v3.8.1/ZR.Repository/BaseRepository.cs#L342-L351
- github.comhttps://github.com/izhaorui/Zr.Admin.NET/commit/d32c211aeedab3e07bb4f02f54bb251fff37361c
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/zradmin-net-order-by-sort-sql-injection
- www.vulncheck.comhttps://www.vulncheck.com/advisories/zr-admin-net-through-3.8.2-sql-injection-via-pagerinfo-sort-order-by
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140396.3 MED—
——0A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.15hCVE-2026-1140847.7 HIG—
——0Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query parameter into the ElectricSQL shape where clause and defeats the runtimeEnvironmentId tenant guard. Authenticated attackers holding any project API key with read:runs scope can append boolean conditions to stream TaskRun records, including payloads and metadata, from every organization on the same self-hosted instance.18hCVE-2026-1140817.7 HIG—
——0Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated ClickHouse SQL without allowlisting or escaping. Authenticated customers can submit a backtick-quoted identifier to POST /api/v1/query that injects a raw subquery outside the per-tenant WHERE guard, exfiltrating other organizations' analytics data.18hCVE-2026-1140656.5 MED—
——0Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.18hCVE-2026-1137406.3 MED—
——0A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.18hCVE-2015-201288.2 HIG—
——0FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries through the CityId parameter. Attackers can send GET requests to /user/City_ajax.aspx with UNION SELECT payloads in CityId, concatenated unsanitized into the sys_City query, to extract database information. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.22h