SQL injection in SocialEngine get-memberall endpoint (CVE-2026-41460)

SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the `/activity/index/get-memberall` endpoint. User-supplied input passed via the `text` parameter is not sanitized before being incorporated into a SQL query, allowing unauthenticated remote attackers to read arbitrary data from the database. This may also be exploited to reset administrator account passwords and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution. Affected versions: - 7.8.0 - 7.7.0 - and likely prior versions We recommend updating to: 8.0.0. CVSS 9.3 · our assessment: act_now Reference: https://karmainsecurity.com/KIS-2026-08 Details: https://vuln.today/cve/CVE-2026-41460