Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 CVE-2026-41460 — CVSS 9.8/10 ██████████ SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/s4UNjVDXDp
Post summary
Disclosed a SQL injection in SocialEngine 7.8.0 and earlier (CVE-2026-41460) with critical severity and an immediate patch available.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | socialengine | socialengine | - | - | - |