PT-2026-6436

Published

2026-01-15

·

Updated

2026-01-15

Description by

CVSS 3.1
8.2
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
GHSA-HM9J-CGMM-2W36
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com