Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-3sxv-jq39-vyap
SummarySQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
Aliases
0
alias CVE-2026-37505
Fixed_packages
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-37505
reference_id
reference_type
scores
0
value 0.00035
scoring_system epss
scoring_elements 0.10729
published_at 2026-06-11T12:55:00Z
1
value 0.00035
scoring_system epss
scoring_elements 0.10758
published_at 2026-06-14T12:55:00Z
2
value 0.00035
scoring_system epss
scoring_elements 0.10789
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-37505
1
reference_url https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9
reference_id 1330e1a82caa79906eec55eeff2c99b9
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-01T19:38:55Z/
url https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9
2
reference_url https://github.com/v2board/v2board
reference_id v2board
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:H/S:U/UI:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-01T19:38:55Z/
url https://github.com/v2board/v2board
Weaknesses
Exploits
Severity_range_score4.9 - 4.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-3sxv-jq39-vyap