SQL Injection in V2board
CVE-2026-37505
SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
Weakness classification (CWE)
References
- github.com/v2board/v2board (Product)
- gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 (Third Party Advisory)
Frequently asked questions
- What is CVE-2026-37505?
- CVE-2026-37505 is a medium-severity vulnerability in V2board, classified under SQL Injection. CVSS score: 4.9/10. Published 2026-05-01.
- How severe is CVE-2026-37505?
- Medium severity. CVSS v3 base score is 4.9 out of 10.