Blind SQL Injection in UBB.threads by UBB Central
CVE-2026-54222

8.6HIGH

Key Information:

Vendor

Ubb Systems

Status
Ubb.threads
Vendor
CVE Published:
18 June 2026

What is CVE-2026-54222?

UBB.threads is susceptible to a Blind SQL Injection vulnerability, which permits attackers who have access to the Members in Control Panel to exploit the underlying database. This flaw arises from inadequate input sanitization, enabling malicious users to execute crafted SQL queries. Through time-based or boolean-based methods, attackers can leverage this vulnerability to extract sensitive data, including user credentials. While the vulnerability has been confirmed in version 7.7.5, it may also affect earlier versions.

Affected Version(s)

UBB.threads 0 <= 7.7.5

References

https://www.ubbcentral.com/
product
https://cert.pl/en/posts/2026/06/CVE-2026-54219
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski (Securitum)
Michał Wnękowicz (Securitum)
.