CVE-2026-112064 — SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the…
Published: 2026-10-20 · CVSS: 7.1 · CVSS 4.0
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
Source: CVE Program · Revision a9e53c2ac1a1379115bf46f7a48872ec11dfa1bb