CVE-2026-67689

CriticalCVSS 9.8

Published: 06/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 07/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.69%

50th percentile - higher than 50% of all known CVEs

Summary

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints.

Risk Assessment

An attacker can gain unauthorized access to the database, exfiltrate data, or execute arbitrary code, potentially leading to full system compromise.

Recommendation

Update FineAdmin to the latest version or apply security patches, and implement input validation and sanitization for the `field` and `order` parameters.

Other vulnerabilities in FineAdmin

CVE-2026-88424Critical
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.

Original NVD description (English source)

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints

Vulnerability data from NVD (NIST) · CISA KEV · EPSS