https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:57:01.628684+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-71292 CVE-2026-71292 — Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter 2026-10-06T23:57:01.645265+00:00

Affected: intelliants subrion

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.