CVE-2026-105146

Name of the Vulnerable Software and Affected Versions Comsenz Discuz! versions X5.0-20260801 through X5.0-20260910

Description An issue exists in the Admin Medal Moderation component within the modmedalsubmit() function of the file upload/source/app/admin/child/medals/mod.php. Remote attackers can perform a SQL injection—a technique used to manipulate a database by inserting malicious SQL code into a query—by manipulating the delete argument.

Recommendations As a temporary workaround, restrict access to the modmedalsubmit() function in the Admin Medal Moderation component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.