CVE-2026-7083

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7083", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T08:03:03.732Z", "datePublished": "2026-04-27T03:30:14.509Z", "dateUpdated": "2026-04-27T12:31:11.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T03:30:14.509Z"}, "title": "likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "likeadmin-likeshop", "product": "likeadmin_php", "versions": [{"version": "1.9.0", "status": "affected"}, {"version": "1.9.1", "status": "affected"}, {"version": "1.9.2", "status": "affected"}, {"version": "1.9.3", "status": "affected"}, {"version": "1.9.4", "status": "affected"}, {"version": "1.9.5", "status": "affected"}, {"version": "1.9.6", "status": "affected"}], "modules": ["dataTable Admin API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\\app\\adminapi\\lists\\tools\\DataTableLists.php of the component dataTable Admin API. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T10:08:08.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "z0ng (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359658", "name": "VDB-359658 | likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359658/cti", "name": "VDB-359658 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799570", "name": "Submit #799570 | Guangzhou Duoduo Information Technology Co., Ltd. likeadmin_php <= 1.9.6 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/likeadmin-likeshop/likeadmin_php/issues/8", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/likeadmin-likeshop/likeadmin_php/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:31:04.280167Z", "id": "CVE-2026-7083", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:31:11.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7083", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:31:04.280167Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:31:08.647Z"}}], "cna": {"title": "likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "z0ng (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.8, "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "likeadmin-likeshop", "modules": ["dataTable Admin API"], "product": "likeadmin_php", "versions": [{"status": "affected", "version": "1.9.0"}, {"status": "affected", "version": "1.9.1"}, {"status": "affected", "version": "1.9.2"}, {"status": "affected", "version": "1.9.3"}, {"status": "affected", "version": "1.9.4"}, {"status": "affected", "version": "1.9.5"}, {"status": "affected", "version": "1.9.6"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T10:08:08.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359658", "name": "VDB-359658 | likeadmin-likeshop likeadmin_php dataTable Admin API DataTableLists.php queryResult sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359658/cti", "name": "VDB-359658 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/799570", "name": "Submit #799570 | Guangzhou Duoduo Information Technology Co., Ltd. likeadmin_php <= 1.9.6 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/likeadmin-likeshop/likeadmin_php/issues/8", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/likeadmin-likeshop/likeadmin_php/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\\app\\adminapi\\lists\\tools\\DataTableLists.php of the component dataTable Admin API. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T03:30:14.509Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7083", "state": "PUBLISHED", "dateUpdated": "2026-04-27T12:31:11.873Z", "dateReserved": "2026-04-26T08:03:03.732Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T03:30:14.509Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["dataTable Admin API"], "product": "likeadmin_php", "vendor": "likeadmin-likeshop", "versions": [{"status": "affected", "version": "1.9.0"}, {"status": "affected", "version": "1.9.1"}, {"status": "affected", "version": "1.9.2"}, {"status": "affected", "version": "1.9.3"}, {"status": "affected", "version": "1.9.4"}, {"status": "affected", "version": "1.9.5"}, {"status": "affected", "version": "1.9.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\\app\\adminapi\\lists\\tools\\DataTableLists.php of the component dataTable Admin API. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en likeadmin-likeshop likeadmin_php hasta 1.9.6. Afectada por este problema es la funci\u00f3n queryResult del archivo servidor\\app\\adminapi\\lists\\tools\\DataTableLists.php del componente dataTable Admin API. La manipulaci\u00f3n conduce a inyecci\u00f3n SQL. El ataque es posible de ser llevado a cabo remotamente. El exploit ha sido divulgado al p\u00fablico y puede ser usado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de problema pero no ha respondido a\u00fan."}], "id": "CVE-2026-7083", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7083", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:31:04.280167Z", "version": "2.0.3"}}]}, "published": "2026-04-27T04:16:09.723", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/likeadmin-likeshop/likeadmin_php/"}, {"source": "cna@vuldb.com", "url": "https://github.com/likeadmin-likeshop/likeadmin_php/issues/8"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/799570"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359658"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359658/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.9.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "likeadmin_php", "source": "cna", "vendor": "likeadmin-likeshop"}, "product": "likeadmin_php", "vendor": "likeadmin-likeshop"}], "analysis": {"en": {"generated_at": "2026-04-28T04:51:11.070103+00:00", "value": {"mitigation_remediation": ["Upgrade likeadmin_php to a version later than 1.9.6 once a fix is released", "Modify the queryResult implementation to use parameterized queries or prepared statements, ensuring all input is properly sanitized", "Deploy a web application firewall rule set to detect and block typical SQL injection patterns targeting the Admin API endpoint"], "summary": {"action": "Immediate Patch", "impact": "SQL injection"}, "threat_synthesis": {"affected_systems": "The issue exists in likeadmin\u2011likeshop\u2019s likeadmin_php component for all releases up to and including version 1.9.6. Systems exposing the DataTable Admin API endpoint through that component are vulnerable.", "description_and_impact": "The vulnerability stems from an unchecked user\u2011supplied parameter in the queryResult method of DataTableLists.php, enabling arbitrary SQL statements to be executed against the database. An attacker who can reach the Admin API endpoint can read, modify or delete data stored in the backend, compromising both confidentiality and integrity. The flaw does not provide direct code execution, but it does grant the attacker full control over database schema and contents.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate exploitation risk. The EPSS score of less than 1% suggests that active exploitation is unlikely as of the current data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a third\u2011party can trigger it by sending a crafted HTTP request to the vulnerable API, assuming no mitigating controls such as input validation or WAF are in place."}}}}, "created": "2026-04-27T19:51:45.422972+00:00", "updated": "2026-04-28T05:00:14.739283+00:00", "vendors": ["likeadmin-likeshop", "likeadmin-likeshop$PRODUCT$likeadmin_php"]}