AUGUST 14, 2026
Live Feed
Back to database
Case File

CVE-2026-72550

CRITICAL · CVSS 9.8 EPSS 0.42% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-11 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

An SQL injection vulnerability in Friendica allows unauthenticated remote attackers to execute arbitrary SQL statements through the unvalidated photo-view order parameter. This critical flaw can lead to unauthorized access, modification, or deletion of the entire database. Organizations using Friendica should prioritize patching this vulnerability to mitigate the risk of severe data breaches.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72550
Severity
CRITICAL
CVSS
9.8
EPSS
0.42%

Original NVD Description

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.