Threats tagged 'ghsa-p9jr-g3jg-h6r7'

CVE-2026-37505 is a SQL Injection vulnerability in V2Board versions up to 1.7.4. It occurs because the 'sort' parameter from authenticated admin user input is passed directly to the database query's ORDER BY clause without validation. This allows an attacker with admin privileges to sort user data by any database column, including sensitive fields like passwords and tokens, potentially leading to information disclosure.