CVE-2026-111669

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

CVE-2026-111669

Versions of ZR.Admin.NET through 3.8.2 are vulnerable to an SQL Injection flaw in the shared ToPage paging helper. An authenticated attacker with system:user:list permissions can manipulate the ORDER BY clause by providing a crafted PagerInfo.Sort query parameter. Specifically, via a GET /system/...

EUVD-2026-102960

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...

PT-2026-116068

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery ...