CVE-2026-15951

Name of the Vulnerable Software and Affected Versions Icegram Mailer versions prior to 1.0.13

Description An issue exists where authenticated attackers with Administrator-level access and above can perform SQL Injection. This occurs because the get logs() function in the Icegram Mailer Logs Table class does not sufficiently escape or prepare the SQL query when processing the fields parameter received from $ REQUEST['data']. Specifically, elements of the fields array are joined directly into the SELECT clause using the implode() function without a whitelist or prepared-statement placeholders, allowing attackers to append malicious SQL queries to extract sensitive information from the database.

Recommendations Update to a version newer than 1.0.12. As a temporary mitigation, restrict access to the fields parameter within the affected functionality to minimize the risk of exploitation.