SQL Injection Vulnerability in Osclass Item Model Handler

CVE-2026-113381

What is CVE-2026-113381?

A vulnerability exists in the Item Model Handler of Osclass, specifically in the function Item::findUserItems located in the file oc-includes/osclass/model/Item.php. This flaw arises from improper handling of input parameters, notably the sPattern argument, which can lead to SQL injection attacks. Such vulnerabilities allow attackers to manipulate backend SQL queries, potentially compromising sensitive data and escalating privileges. The vulnerability can be exploited remotely, making it crucial for users of affected versions to apply security patches and review their security configurations.

References