CVE-2026-61518

Name of the Vulnerable Software and Affected Versions ISPConfig (affected versions not specified)

Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner fails to block quote-free boolean payloads and does not reject requests by default. A remote API user with any low-privilege function permission can execute arbitrary SQL to modify or delete records across all tenants in the control panel database and extract sensitive data, such as password hashes and client records, using blind boolean inference (a technique used to extract data by asking the database true/false questions).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.