CVE-2026-61518: Improper Neutralization of Special Elements used in an SQL Command

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...