CVE-2026-67689

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Updated: 07/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

33th percentile - higher than 33% of all known CVEs

Summary

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints.

Risk Assessment

An attacker can gain unauthorized access to the database, exfiltrate data, or execute arbitrary code, potentially leading to full system compromise.

Recommendation

Update FineAdmin to the latest version or apply security patches, and implement input validation and sanitization for the `field` and `order` parameters.

Original NVD description (English source)

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints