Live › vulnerability › CVE-2026-111669
Go to dashboardZR.Admin.NET through 3.8.2 lets a logged-in user inject SQL into the ORDER BY clause via the PagerInfo.Sort parameter of the shared paging helper. An attacker holding the system:user:list permission can use blind techniques through GET /system/user/list to extract database contents such as stored credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running ZR.Admin.NET version 3.8.2 or earlier with a user account that holds the system:user:list permission are exposed. Installations where only fully trusted administrators can log in, or that do not use this admin panel, have less exposure. The sources do not say whether default configurations differ.
No product ranges from the sources yet.
3.8.2 once available (unknown from sources which version is fixed).system:user:list permission to trusted roles and rotate stored credentials if exposure is suspected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.
This page as .md · .json · in your agent: get_signal("CVE-2026-111669")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.