https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T18:11:52.224131+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-28562 CVE-2026-28562 — wpForo Forum 2.4.14 SQL Injection via Topics ORDER BY Parameter 2026-10-09T18:11:52.240583+00:00

Affected: gVectors Team wpForo Forum

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payloads to perform blind boolean extraction of credentials from the WordPress database.