CVE-2026-67689

CVE-2026-67689 : FineAdmin.Mvc is vulnerable to SQL injection via the field and order parameters in paginated list endpoints. The root cause is direct, unsanitized string concatenation of pageInfo.field and pageInfo.order into the ORDER BY clause (via string.Format), allowing expressions in MySQL...