CVE-2026-71622
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component.
Risk Assessment
SQL injection may allow an attacker to read, modify, or delete data in the database, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update APiAdmin to the latest version and verify if the issue has been fixed.
Other vulnerabilities in APiAdmin
See all- CVE-2026-88397Unknown
ApiAdmin v5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
- CVE-2026-88396Unknown
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim with no whitelist, blacklist or content check, and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
- CVE-2026-71620High
File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file.
Original NVD description (English source)
SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component
Vulnerability data from NVD (NIST) · CISA KEV · EPSS