PT-2026-69373

CVE-2026-18666

·

Published

2026-08-05

·

Updated

2026-08-10

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Library Management System versions prior to 3.6.7
Description Insufficient sanitization and escaping of a user-supplied parameter used in a SQL statement allows users with roles as low as Subscriber to perform SQL injection. This can lead to the extraction of arbitrary data from the database, including user password hashes.
Recommendations Update Library Management System to version 3.6.7 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-18666
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com