CVE-2026-41460

🗓️ 23 Apr 2026 13:44:51Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 11 Views🌐 WEB

SQL injection in SocialEngine before 7.8.0 via get-memberall allows unauthenticated data access and admin password reset.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-41460	23 Apr 202613:44	–	attackerkb
Circl	CVE-2026-41460	23 Apr 202619:43	–	circl
CNNVD	SocialEngine SQL注入漏洞	23 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-41460 SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall	23 Apr 202613:44	–	cvelist
EUVD	EUVD-2026-25224	23 Apr 202618:33	–	euvd
NVD	CVE-2026-41460	23 Apr 202615:37	–	nvd
Packet Storm	📄 SocialEngine 7.8.0 SQL Injection	23 Apr 202600:00	–	packetstorm
Positive Technologies	PT-2026-34664	23 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-41460	29 Apr 202620:48	–	redhatcve
Vulnrichment	CVE-2026-41460 SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall	23 Apr 202613:44	–	vulnrichment

NVD

Vulners

Node

socialengine socialengineRange≤7.8.0

[
  {
    "vendor": "SocialEngine",
    "product": "SocialEngine",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "7.8.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
karmainsecurity	www.karmainsecurity.com/KIS-2026-08
socialengine	www.socialengine.com/
vulncheck	www.vulncheck.com/advisories/socialengine-sql-injection-via-activity-index-get-memberall
karmainsecurity	www.karmainsecurity.com/pocs/CVE-2026-41460.php
seclists	www.seclists.org/fulldisclosure/2026/Apr/12

Parameter	Position	Path	Description	CWE
text	query param	/activity/index/get-memberall	SQL injection in get-memberall via unsanitized text parameter	CWE-89

29 Apr 2026 20:16Current

6.3Medium risk

Vulners AI Score6.3

CVSS 49.3

CVSS 3.19.8

EPSS0.0046

SSVC

CWE-89