Description
SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.
Published: 2026-04-23
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A SQL injection flaw exists in the /activity/index/get-memberall endpoint of SocialEngine 7.8.0 and earlier. Unsanitized user-supplied text parameter is incorporated directly into a SQL query, allowing an unauthenticated remote attacker to read arbitrary data, reset administrator passwords, or access the Packages Manager, potentially leading to full remote code execution.

Affected Systems

The vulnerability affects all SocialEngine installations that are version 7.8.0 or lower. The affected product is SocialEngine, the vendor SocialEngine, and the specific affected versions are 7.8.0 and earlier.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity. EPSS < 1% shows a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw from outside the network by sending crafted requests to the vulnerable endpoint; no authentication is required.

Generated by OpenCVE AI on April 28, 2026 at 07:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SocialEngine to version 7.8.1 or later to eliminate the SQL injection flaw.
  • Until an upgrade is possible, block unauthenticated access to the /activity/index/get-memberall endpoint using a firewall or web application firewall rule.
  • After applying the patch or workaround, audit the database for unauthorized queries, enforce strong credentials and enable two‑factor authentication for the admin panel.

Generated by OpenCVE AI on April 28, 2026 at 07:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
References

Wed, 29 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 27 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Socialengine
Socialengine socialengine
CPEs cpe:2.3:a:socialengine:socialengine:*:*:*:*:*:*:*:*
Vendors & Products Socialengine
Socialengine socialengine

Thu, 23 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.
Title SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Socialengine Socialengine
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-29T19:32:19.791Z

Reserved: 2026-04-20T16:07:47.310Z

Link: CVE-2026-41460

cve-icon Vulnrichment

Updated: 2026-04-29T19:32:19.791Z

cve-icon NVD

Status : Modified

Published: 2026-04-23T15:37:24.540

Modified: 2026-04-29T20:16:30.790

Link: CVE-2026-41460

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T07:45:26Z

Weaknesses