What is the CVSS score of CVE-2026-28226?

CVE-2026-28226 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Phishing Club are affected by CVE-2026-28226?

Organizations using the GetOrphaned recipient listing endpoint in should be aware of notable risk from CVE-2026-28226, a SQL injection vulnerability rated CVSS 6.5.. A patch is available.

Is there a public PoC exploit available for CVE-2026-28226?

Yes, a public proof-of-concept exploit is available for CVE-2026-28226. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28226?

Within 30 days: Identify affected systems running the GetOrphaned recipient listing endpoint in and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Phishing Club CVE-2026-28226

MEDIUM

SQL Injection (CWE-89)

2026-02-26 security-advisories@github.com

SQLi Phishing Club

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

PoC Detected

Mar 03, 2026 - 00:44 vuln.today

Public exploit code

Patch released

Mar 03, 2026 - 00:44 nvd

Patch available

CVE Published

Feb 26, 2026 - 23:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through RemapOrderBy(), an authenticated attacker can inject SQL expressions into the ORDER BY clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

AnalysisAI

SQL injection in Phishing Club's GetOrphaned recipient endpoint allows authenticated attackers to manipulate ORDER BY clauses by injecting malicious SQL expressions through an unvalidated sortBy parameter. Public exploit code exists for this vulnerability, affecting versions prior to 1.30.2, where attackers can extract sensitive data despite the lack of direct integrity or availability impact. The vulnerability has been patched in v1.30.2 through implementation of column allowlist validation.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the GetOrphaned recipient listing component of Phishing Club. Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through RemapOrderBy(), an authenticated attacker can inject SQL expressions

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.