Is there a patch available for CVE-2026-6982?

Yes, a patch is available for CVE-2026-6982. Update the affected software to the latest version immediately.

ShowDoc CVE-2026-6982

Q: What is the CVSS score of CVE-2026-6982?

CVE-2026-6982 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25658 MEDIUM

SQL Injection (CWE-89)

2026-04-25 VulDB

PHP SQLi

5.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 25, 2026 - 15:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 15:15 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 15:00 euvd

EUVD-2026-25658

Analysis Generated

Apr 25, 2026 - 15:00 vuln.today

Patch released

Apr 25, 2026 - 15:00 nvd

Patch available

CVE Published

Apr 25, 2026 - 14:30 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."

AnalysisAI

SQL injection in ShowDoc API Page Sort Endpoint allows authenticated remote attackers to manipulate the pages parameter and execute arbitrary SQL queries with limited confidentiality, integrity, and availability impact. Affected versions include 2.10.10, 3.6.2, and 3.8.0; vendor has released patch v3.8.1 but explicitly stated no backports will be provided for older versions.

Technical ContextAI

ShowDoc is a PHP-based API documentation platform. The vulnerability resides in the PageController class within the API Page Sort Endpoint (server/Application/Api/Controller/PageController.class.PHP). The pages parameter passed to this endpoint is not properly sanitized before being used in SQL queries, allowing attackers to inject arbitrary SQL commands. CWE-89 (SQL Injection) indicates the application fails to neutralize special characters or properly parameterize user input before constructing dynamic SQL statements. The affected component processes page sorting logic, which typically involves database queries to retrieve and order documentation pages.

RemediationAI

Upgrade ShowDoc to version 3.8.1 or later immediately, as this is the vendor-released patch that addresses the SQL injection vulnerability. The upgrade is available via GitHub at https://github.com/star7th/showdoc/releases/tag/v3.8.1. For users of older versions (2.10.10 and 3.6.2), the vendor has explicitly stated no backports will be provided; therefore, immediate upgrade to v3.8.1+ is the only official remediation path. As a compensating control pending upgrade, restrict network access to the ShowDoc API to trusted internal networks only, implement Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the pages parameter (trade-off: may generate false positives with legitimate requests containing special characters), and enforce principle of least privilege by limiting API access to documented users who genuinely require page sorting functionality. Additionally, enable application-level logging and monitoring for SQL errors or unusual database query patterns originating from the PageController endpoint to detect exploitation attempts.