Socialengine
Monthly
Unauthenticated SQL injection in SocialEngine (versions ≤7.8.0) via the text parameter of the /activity/index/get-memberall endpoint lets remote attackers read arbitrary database contents, reset administrator passwords, and reach the Admin Panel's Packages Manager - a path that can escalate to remote code execution. A public proof-of-concept exists (KarmaInSecurity KIS-2026-08) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low at 0.17%. No public exploit in CISA KEV, so this is publicly available exploit code rather than confirmed active exploitation.
Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized `uri` parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.
Unauthenticated SQL injection in SocialEngine (versions ≤7.8.0) via the text parameter of the /activity/index/get-memberall endpoint lets remote attackers read arbitrary database contents, reset administrator passwords, and reach the Admin Panel's Packages Manager - a path that can escalate to remote code execution. A public proof-of-concept exists (KarmaInSecurity KIS-2026-08) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low at 0.17%. No public exploit in CISA KEV, so this is publicly available exploit code rather than confirmed active exploitation.
Blind server-side request forgery in SocialEngine 7.8.0 and prior allows authenticated remote attackers to weaponize the server as an HTTP proxy against internal infrastructure via the /core/link/preview endpoint's unsanitized `uri` parameter. The vulnerability enables internal network enumeration, discovery of non-externally-reachable services, and potential access to cloud metadata endpoints such as AWS IMDSv1. EPSS is very low at 0.04% (11th percentile) with no active exploitation identified (not in CISA KEV, SSVC exploitation=none), but the CVSS 4.0 subsequent-system confidentiality score of High signals meaningful lateral risk in cloud-hosted or network-rich deployments.