CVE-2026-73670

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A CMS contains a SQL injection flaw in the 'admin/db data.php' endpoint. Authenticated administrators can inject arbitrary SQL into a SHOW COLUMNS FROM statement by providing unsanitized input via the table name GET or POST parameter. This allows for table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate the full database schema and access system tables such as information schema. This disclosure can be chained with secondary injection points to extract credential data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the table name parameter in the 'admin/db data.php' endpoint until the issue is resolved.