Vulnerability · Published Apr 23, 2026 · Assigned by VulnCheck
CVE-2026-41460SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall
Critical 9.8
In plain English
A critical-severity SQL injection in SocialEngine from SocialEngine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, potentially enabling remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SocialEngine | SocialEngine | 0 – through 7.8.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://karmainsecurity.com/KIS-2026-08 technical-description
- https://socialengine.com product
- https://www.vulncheck.com/advisories/socialengine-sql-injection-via-activity-index-get-memberall third-party-advisory
- https://karmainsecurity.com/pocs/CVE-2026-41460.php exploit
- http://seclists.org/fulldisclosure/2026/Apr/12