SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
References
| Link | Resource |
|---|---|
| https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 | Third Party Advisory |
| https://github.com/v2board/v2board | Product |
Configurations
History
11 May 2026, 19:26
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
V2board v2board
V2board |
|
| CPE | cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:* | |
| References | () https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 - Third Party Advisory | |
| References | () https://github.com/v2board/v2board - Product |
01 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 |
01 May 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-01 16:16
Updated : 2026-05-11 19:26
NVD link : CVE-2026-37505
Mitre link : CVE-2026-37505
CVE.ORG link : CVE-2026-37505
JSON object : View
Products Affected
v2board
- v2board
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')