EUVD-2026-25766Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\app\adminapi\lists\tools\DataTableLists.php of the component dataTable Admin API. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
SQL injection in likeadmin_php up to version 1.9.6 allows high-privilege remote attackers to manipulate SQL queries through the queryResult function in the dataTable Admin API component, potentially exposing or modifying sensitive database content. Public exploit code exists and the vendor has not yet responded to early notification, elevating risk despite the CVSS score of 5.1 reflecting high-privilege authentication requirements.
Technical ContextAI
The vulnerability exists in the dataTable Admin API endpoint (specifically server/app/adminapi/lists/tools/DataTableLists.php) where the queryResult function fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL query construction. This represents a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as SQL injection) vulnerability. The PHP application likely constructs dynamic SQL strings using string concatenation or unsafe query building rather than prepared statements with bound parameters. The attack is remotely exploitable over the network (AV:N/AC:L) but requires high privilege-level authentication (PR:H), suggesting the vulnerable endpoint is part of an admin API where authenticated administrators interact with data table filtering or querying functionality.
RemediationAI
No vendor-released patch has been identified at time of analysis despite early notification to the project maintainers. Organizations running likeadmin_php should immediately monitor the official GitHub repository (https://github.com/likeadmin-likeshop/likeadmin_php/releases) for a patched release version. As interim compensating controls: (1) Restrict network access to the admin API endpoint (server/app/adminapi/) using firewall rules or WAF rules to limit exposure only to trusted administrator IP ranges, accepting the trade-off of operational friction for remote admin access; (2) Implement database-level privilege restrictions so that the web application database account lacks DROP, TRUNCATE, or stored procedure execution permissions, limiting data exfiltration scope even if SQL injection is exploited; (3) Enable and monitor database query logging and audit trails to detect suspicious SQL patterns (e.g., UNION SELECT, OR 1=1) from the application account; (4) Enforce strong, unique passwords and multi-factor authentication (MFA) for all admin accounts to reduce the likelihood of credential compromise enabling exploitation. These controls mitigate but do not eliminate risk - patching remains essential once available.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today