SQL Injection Vulnerability in SocialEngine by SocialEngine
CVE-2026-41460

9.3CRITICAL

Key Information:

Vendor: Socialengine
Status: Socialengine
Vendor: CVE Published:; 23 April 2026

🔔 Create Socialengine Vulnerability Alert

What is CVE-2026-41460?

SocialEngine versions up to 7.8.0 are vulnerable to a SQL injection flaw in the /activity/index/get-memberall endpoint. This issue arises from the lack of sanitization of user-supplied input in the text parameter, allowing unauthenticated attackers to manipulate SQL queries. Exploiting this vulnerability could allow attackers to read sensitive data stored in the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager within the Admin Panel, which may lead to remote code execution. Organizations using affected versions should take immediate measures to secure their applications.