CVE-2026-51946 - Vulnerability Details

Description

SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints

Published: 2026-07-01

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A SQL Injection flaw exists in the __sort_type query parameter of all /admin/info/{table} endpoints in GoAdminGroup GoAdmin. By supplying a crafted value, an attacker can inject arbitrary SQL statements that are executed against the underlying database. Successful exploitation can lead to extraction or modification of sensitive data, and if the database user has elevated privileges, could enable host‑level code execution, effectively giving the attacker remote code execution capabilities.

Affected Systems

The vulnerability applies to GoAdminGroup GoAdmin version 1.2.26, the latest release at the time of discovery. All instances that expose the /admin interface without additional safeguards are affected.

Risk and Exploitability

The CVSS score is 6.5, indicating moderate severity. The EPSS score is below 1 %, suggesting a low overall probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, a remote attacker can exploit the flaw by sending a crafted request to the /admin/info/{table} endpoint; no authentication requirement is specified, implying that the vector is likely reachable by unauthenticated users who can reach the web interface.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a patched version of GoAdmin that sanitizes or removes the __sort_type parameter or validates it against a whitelist of accepted values.
Configure network defenses so that the /admin interface is only reachable from trusted internal networks or protected by a VPN or firewall.
If a patch is unavailable, enforce strict input validation by accepting only known safe values for __sort_type and rejecting all others, or refactor the affected code to use parameterized queries instead of dynamic SQL.

Generated by OpenCVE AI on August 3, 2026 at 06:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00336.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://blog.silentgrid.com/ai-assisted-penetration-testing-in-practice/
https://github.com/GoAdminGroup/go-admin/tree/main

History

Mon, 03 Aug 2026 06:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdmin Group’s Admin Endpoints Allowing Remote Code Execution

Wed, 29 Jul 2026 22:15:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdmin Group’s Admin Endpoints Allowing Remote Code Execution

Sat, 25 Jul 2026 23:00:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection via __sort_type in GoAdminGroup GoAdmin

Tue, 21 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection via __sort_type in GoAdminGroup GoAdmin

Fri, 17 Jul 2026 13:45:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection via __sort_type Parameter in GoAdminGroup GoAdmin

Wed, 15 Jul 2026 23:15:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection via __sort_type Parameter in GoAdminGroup GoAdmin

Tue, 14 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdminGroup GoAdmin Allowing Remote Code Execution

Mon, 13 Jul 2026 04:45:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdminGroup GoAdmin Allowing Remote Code Execution

Sun, 12 Jul 2026 10:15:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection Vulnerability in GoAdminGroup GoAdmin via __sort_type Parameter

Sat, 11 Jul 2026 09:00:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection Vulnerability in GoAdminGroup GoAdmin via __sort_type Parameter

Fri, 10 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdmin Admin Sort Parameter Allows Remote Code Execution

Fri, 10 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdmin Admin Sort Parameter Allows Remote Code Execution

Thu, 09 Jul 2026 07:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdmin via __sort_type Parameter

Wed, 08 Jul 2026 19:15:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdmin via __sort_type Parameter

Wed, 08 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title	Arbitrary Code Execution via SQL Injection in GoAdmin Sort-Type Parameter

Tue, 07 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		Arbitrary Code Execution via SQL Injection in GoAdmin Sort-Type Parameter

Mon, 06 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdmin 1.2.26 via __sort_type Parameter

Mon, 06 Jul 2026 07:00:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdmin 1.2.26 via __sort_type Parameter

Sun, 05 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection Vulnerability in GoAdminGroup GoAdmin Enables Remote Code Execution

Sun, 05 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection Vulnerability in GoAdminGroup GoAdmin Enables Remote Code Execution

Sat, 04 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection via __sort_type Parameter in GoAdmin

Sat, 04 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection via __sort_type Parameter in GoAdmin

Fri, 03 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection in GoAdmin Admin Interface Allows Remote Code Execution

Fri, 03 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection in GoAdmin Admin Interface Allows Remote Code Execution

Thu, 02 Jul 2026 14:15:00 +0000

Type	Values Removed	Values Added
Title	SQL Injection via __sort_type Parameter Allowing Remote Code Execution in GoAdminGroup GoAdmin

Thu, 02 Jul 2026 00:00:00 +0000

Type	Values Removed	Values Added
Title		SQL Injection via __sort_type Parameter Allowing Remote Code Execution in GoAdminGroup GoAdmin

Wed, 01 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-89
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description		SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
References		https://blog.silentgrid.com/ai-assisted-penetration-testing-in-practice/ https://github.com/GoAdminGroup/go-admin/tree/main

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-07-01T00:00:00.000Z

Updated: 2026-07-01T18:07:49.066Z

Reserved: 2026-06-08T00:00:00.000Z

Link: CVE-2026-51946

Vulnrichment

Updated: 2026-07-01T18:07:38.731Z

NVD

Status : Deferred

Published: 2026-07-01T18:16:34.193

Modified: 2026-07-02T18:43:45.710

Link: CVE-2026-51946

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-03T06:15:04Z

Weaknesses

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object