EUVD-2026-72959
GHSA-mx79-r5c6-vfx4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N); description limits impact to reading sensitive data, so C:H but I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
AnalysisAI
SQL injection in Movie_Recommend v1.0.0 lets remote unauthenticated attackers read arbitrary database contents by injecting crafted SQL through the 'sort' parameter of the /loadingmore endpoint. A public write-up with exploitation details exists on GitHub, but the flaw is not in CISA KEV and no active exploitation is reported. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Movie_Recommend v1.0.0 web application and the ability to send a crafted value in the 'sort' parameter of the /loadingmore endpoint; no authentication or user interaction is indicated by the CVSS vector (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects unauthenticated, low-complexity network exploitation, which is consistent with a public-facing web SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Movie_Recommend v1.0.0 and immediately isolate them from untrusted networks or place them behind a Web Application Firewall configured to block SQL injection patterns in the 'sort' parameter. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today