Which versions of SocialEngine are affected by CVE-2026-41460?

SocialEngine installations running version 7.8.0 and earlier can be compromised by remote attackers without credentials, allowing complete access to user databases and administrator accounts.

How to fix or mitigate CVE-2026-41460?

Within 24 hours, implement network-level restrictions limiting SocialEngine access to known-good internal networks only, and deploy WAF rules to block SQL injection patterns in the /activity/index/get-memberall endpoint; audit all internet-facing SocialEngine deployments to identify exposure. Within 7 days, isolate SocialEngine systems to a segmented network with enhanced logging, inventory all SocialEngine installations organization-wide, and enable database transaction logging to detect unauthorized access. Within 30 days, prepare a vendor patch deployment plan or migration strategy to an alternative platform, and conduct forensic analysis of database logs and admin account activity for signs of prior exploitation.

SocialEngine CVE-2026-41460

Q: What is the CVSS score of CVE-2026-41460?

CVE-2026-41460 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-25224 CRITICAL

SQL Injection (CWE-89)

2026-04-23 VulnCheck

Authentication Bypass RCE SQLi Socialengine

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network endpoint with trivial injection (AV:N/AC:L/PR:N/UI:N); arbitrary DB read plus admin takeover and package-based RCE justify C:H/I:H/A:H, scope unchanged as impact stays within the app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 14:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 23, 2026 - 15:00 euvd

EUVD-2026-25224

Analysis Generated

Apr 23, 2026 - 15:00 vuln.today

CVE Published

Apr 23, 2026 - 13:44 nvd

CRITICAL 9.3

DescriptionCVE.org

SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.

AnalysisAI

Unauthenticated SQL injection in SocialEngine (versions ≤7.8.0) via the text parameter of the /activity/index/get-memberall endpoint lets remote attackers read arbitrary database contents, reset administrator passwords, and reach the Admin Panel's Packages Manager - a path that can escalate to remote code execution. A public proof-of-concept exists (KarmaInSecurity KIS-2026-08) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low at 0.17%. No public exploit in CISA KEV, so this is publicly available exploit code rather than confirmed active exploitation.

Technical ContextAI

SocialEngine is a commercial PHP-based social networking / community platform used to build member-driven websites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the get-memberall action of the activity controller incorporates the user-supplied text parameter directly into a SQL query without sanitization or parameterization. Because the vulnerable endpoint is reachable without authentication, an attacker can manipulate the query grammar to extract data (classic in-band or blind SQLi). The CPE cpe:2.3:a:socialengine:socialengine:*:*:*:*:*:*:*:* confirms the affected product is the SocialEngine application across all versions up to the fixed release. The impact chain is notable: database read access exposes the admin password hash / allows password reset, which then unlocks the Packages Manager - an administrative feature that can install packages and thereby write code to the server, converting a data-disclosure bug into RCE.

RemediationAI

Upgrade SocialEngine to a release later than 7.8.0 as the primary fix; no exact fixed version number is stated in the available data, so consult the vendor at https://socialengine.com and the advisories (https://karmainsecurity.com/KIS-2026-08 and https://www.vulncheck.com/advisories/socialengine-sql-injection-via-activity-index-get-memberall) to confirm the patched build before deploying. Until a patched version is applied, restrict or block access to the /activity/index/get-memberall endpoint at a WAF or reverse proxy and add a signature/rule that rejects SQL metacharacters in the text parameter (trade-off: WAF rules can be bypassed and may break legitimate activity-feed member lookups). As a stronger compensating control, place the application behind authentication or IP allow-listing at the network edge if the community site's use case permits (trade-off: breaks public/anonymous browsing, which is often the point of a social platform). After any suspected exposure, rotate all administrator credentials and audit the Packages Manager for unauthorized package installs, since successful exploitation can reset admin passwords and lead to code execution.