Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47763Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
High 8.2
In plain English
A high-severity SQL injection in Aimeos Laravel ecommerce platform from Aimeos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.3%top 72.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | aimeos/aimeos-laravel | no fix listed | GHSA-hm9j-cgmm-2w36 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Aimeos | Aimeos Laravel ecommerce platform | Aimeos 2021.10 LTS |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-50538 exploit
- Vendor Homepage product
- Aimeos Laravel E-Commerce Package product