CVE-2026-88424

CVSS 9.8 (critical) · published 2026-10-05

FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.

Weakness: CWE-89

Source: NVD CVE-2026-88424

References

• https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29
• https://github.com/xuex86438-netizen/FineAdmin.Mvc-Pagination-Sort-Parameter-SQL-Injection-Permissions-Button-List-/blob/main/FineAdmin.Mvc%20Pagination%20Sort-Parameter%20SQL%20Injection%20%28/Permissions/Button/List%29

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.