The vulnerability CVE-2026-7083 affects the likeadmin-likeshop likeadmin_php product up to version 1.9.6. It is caused by improper handling of input in the queryResult function of the server\app\adminapi\lists\tools\DataTableLists.php file, leading to SQL injection. The flaw allows remote attackers with high privileges to inject malicious SQL commands, potentially compromising the database. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data disclosure, data modification, or other database impacts. However, the impact is limited by the requirement for high privileges and the low overall CVSS score. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the issue report. Organizations using affected versions should consider restricting access to the affected component and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.