CVE-2026-111669

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111669
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111669.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111669
Published
2026-10-16T17:39:31Z
Modified
2026-10-22T10:31:04Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
Details

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111669.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "3.8.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "3.8.2"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/izhaorui/zr.admin.net

Affected ranges

Type
GIT
Repo
https://github.com/izhaorui/zr.admin.net
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d32c211aeedab3e07bb4f02f54bb251fff37361c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "d32c211aeedab3e07bb4f02f54bb251fff37361c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v3.*
v3.7.5
v3.7.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111669.json"