Critical · 9.8 CVE-2026-88424 EUVD-2026-92704GHSA-3722-82pp-q7c6

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). Th…

Published Oct 5, 2026 · Updated Oct 6, 2026 · Assigned by mitre

Description

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.

References

https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29