What is the CVSS score of CVE-2026-37505?

CVE-2026-37505 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

V2Board CVE-2026-37505

EUVD-2026-26669 MEDIUM

SQL Injection (CWE-89)

2026-05-01 mitre

PHP Information Disclosure SQLi

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 16:30 vuln.today

EUVD ID Assigned

May 01, 2026 - 16:00 euvd

EUVD-2026-26669

Analysis Generated

May 01, 2026 - 16:00 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

MEDIUM 4.9

DescriptionCVE.org

SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.

AnalysisAI

Authenticated admin users in V2Board through version 1.7.4 can exploit unsanitized sort parameters in the user management interface to disclose sensitive database information including password hashes and authentication tokens through ORDER BY-based information disclosure. The vulnerability requires admin privileges and does not enable data modification or service disruption, but allows attackers with administrative access to extract confidential user data by analyzing sort order patterns.

Technical ContextAI

V2Board is a PHP-based subscription management application. The vulnerability exists in app/Http/Controllers/Admin/UserController.php where the sort parameter is directly passed to Laravel's User::orderBy() method without validation or sanitization. While this is technically SQL injection in the ORDER BY clause, the impact is limited to information disclosure rather than arbitrary query execution, because ORDER BY accepts only column names and sort direction without string concatenation into query predicates. The CWE classification is not provided, but this follows CWE-89 (SQL Injection) patterns where unsanitized input influences SQL query structure. An attacker with admin credentials can request the user list with manipulated sort parameters pointing to sensitive columns like 'password' or 'remember_token', and infer data values through response ordering or timing analysis.

RemediationAI

Upgrade V2Board to a patched version beyond 1.7.4 if available from the vendor or community repository. If no patched version is immediately available, implement input validation in UserController.php by whitelisting allowed sort columns to a predefined list (e.g., ['id', 'email', 'created_at', 'name']) and rejecting any sort parameter not in the whitelist before passing to orderBy(). Additionally, restrict the sort parameter to alphanumeric characters and underscore only using a regex pattern like /^[a-z_]+$/i. Apply these controls at the controller level before any database query construction. As a temporary compensating control, restrict admin panel access to a specific IP range or require additional authentication layer (VPN, bastion host) to reduce the window for credential compromise attacks. Monitor admin API logs for unusual sort parameter values or patterns suggesting enumeration attempts. No vendor-released patch version is confirmed in the provided data.