Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-100847AzuraCast before 0.23.8 DQL Injection via sortOrder
High 7.5
In plain English
A high-severity SQL injection in AzuraCast from AzuraCast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settings.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-jqwc-h3rq-frmw) vendor-advisory
- VulnCheck Advisory: AzuraCast before 0.23.8 DQL Injection via sortOrder third-party-advisory