Description
SQL injection vulnerability in blogs/admin.php in b2evolution before 4.1.7 allows remote authenticated administrators to execute arbitrary SQL commands via the show_statuses[] parameter. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Remediation
References
Related Vulnerabilities
WordPress 6.0.x Shortcode Execution (6.0 - 6.0.4)
WordPress 3.8.x Multiple Vulnerabilities (3.8 - 3.8.14)
Envoy Proxy NULL Pointer Dereference Vulnerability (CVE-2026-47221)
WordPress 5.3.x Multiple Vulnerabilities (5.3 - 5.3.10)
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-16633)