PT-2026-145525

CVE-2026-65971

·

Published

2026-11-11

·

Updated

2026-11-11

Description by

CVSS 3.1
7.6
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions Livewire PowerGrid versions 6.0.0 through 6.10.3
Description An issue exists where the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause without being restricted to asc/desc. This allows arbitrary SQL injection via the 'POST /livewire/update' endpoint.
Recommendations Update Livewire PowerGrid to version 6.10.4.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-65971
GHSA-7FGC-3H6C-698R
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com