SQL Injection in Power-Components Livewire-Powergrid
CVE-2026-65971
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
- Power-Components Livewire-Powergrid — versions >= 6.0.0, < 6.10.4
Weakness classification (CWE)
Public exploits and proof-of-concept code
1 public repository with exploit or proof-of-concept code for this CVE:
- BiiTts/POC-CVE-2026-65971 (last pushed 2026-07-23): Proof-of-concept and technical write-up for CVE-2026-65971 — SQL injection via the sortDirection Livewire property in power-components/livewire-powergrid (< 6.10.4)
References
This CVE has public exploit evidence. See the latest CVEs with public exploits.