CVE-2026-28226

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-28226
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28226.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-28226
Aliases
  • GHSA-4r69-4qff-ccj3
Published
2026-02-26T22:43:05.629Z
Modified
2026-03-03T02:56:56.964802Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing
Details

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through RemapOrderBy(), an authenticated attacker can inject SQL expressions into the ORDER BY clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28226.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/phishingclub/phishingclub

Affected ranges

Type
GIT
Repo
https://github.com/phishingclub/phishingclub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3eb7e42f9350bac47f4b076d01b756b469015695

Affected versions

v1.*
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.13.1
v1.14.0
v1.15.0
v1.15.1
v1.16.0
v1.17.0
v1.17.1
v1.18.0
v1.19.0
v1.2.0
v1.2.1
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.1
v1.28.0
v1.29.0
v1.3.0
v1.3.1
v1.30.0
v1.30.1
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.9.0
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28226.json"