Log in Start free

Vulnerability · Published Apr 25, 2026 · Assigned by VulDB

CVE-2026-6982star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in ShowDoc from star7th. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 84.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Application/Api/Controller/PageController.class.PHP of the component API Page Sort Endpoint. Executing a manipulation of the argument pages can lead to sql injection. The attack may be launched remotely. Upgrading to version 3.8.1 addresses this issue. It is suggested to upgrade the affected component. According to the researcher, "[t]he vendor explicitly stated they will not backport patches to the older affected versions."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistshowdoc/showdoc3.8.1GHSA-fm5r-cj7v-rj2c

Affected products (as reported)

VendorProductVersions
star7th ShowDoc 2.10.02.10.12.10.22.10.32.10.42.10.52.10.62.10.7

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References