VULNERABILITY INTELLIGENCE

CVE-2026-111669

CVSS score7.1 HIGH

EPSS probability0.21%

CISA KEVNot currently listed

Published2026-10-16

Last modified2026-10-21

Description

ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or …