CyberRota
Back to database

CVE-2026-37505

MEDIUM · CVSS 4.9 EPSS 0.03% Public Exploit

Source: NVD + CISA KEV + EPSS · Published: 2026-05-01 · Last synced: 2026-05-31

CyberRota Analysis

SQL Injection riski içeriyor.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
gist.github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-37505
Severity
MEDIUM
CVSS
4.9
EPSS
0.03%

Original NVD Description

SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.