CVE-2026-72550

CRITICAL9.8

Published 2026-08-11 · Updated 2026-08-11 · Source 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-89

References

https://github.com/friendica/friendica

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-71384
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, potentially resulting in an application denial-of-service condition. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.
2026-08-11 · score 9.6
CVE-2026-70306
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
2026-08-11 · score 9.3
CVE-2026-65791
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8
CVE-2026-62893
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8
CVE-2026-62878
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
2026-08-11 · score 9.8