CVE-2026-88424

CriticalCVSS 9.8

Published: 05/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.

Risk Assessment

An attacker can read, modify, or delete database data, potentially leading to information disclosure or data integrity loss.

Recommendation

Upgrade FineAdmin to the latest version or use parameterized queries and input validation in the GetListByFilter() method.

Other vulnerabilities in FineAdmin

CVE-2026-67689Critical
SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS