CVE-2026-105149 mooSocial CVE debrief

Who should care

Defenders of systems using mooSocial up to 3.2.4 should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify inventory for potentially affected systems and review compensating controls for exposed systems. The potential impact on data confidentiality and integrity requires immediate attention from defenders to prevent potential data breaches.

Why it matters

CVE-2026-105149 is a SQL injection vulnerability in mooSocial up to 3.2.4 that can be exploited remotely. Defenders should assess exposure, prioritize remediation, and verify inventory for potentially affected systems.

• Verify inventory for potentially affected systems
• Assess exposure for systems using mooSocial up to 3.2.4
• Prioritize remediation for potentially affected systems

Technical summary

The SQL injection vulnerability in mooSocial up to 3.2.4 is located in the /stores/all-products file and can be exploited remotely by manipulating the rating argument. The exploit has been publicly released, which increases the risk of attacks. Defenders should assess the potential impact on data confidentiality and integrity and prioritize remediation for potentially affected systems. The vulnerability affects the confidentiality and integrity of the data processed by the affected systems. The vendor's lack of response to the disclosure may affect the reliability of the provided information.

Defensive priority

Remediation is recommended for systems using affected mooSocial versions. Verify inventory for potentially affected systems.

Recommended defensive actions

• Assess exposure for systems using mooSocial up to 3.2.4
• Prioritize remediation for potentially affected systems
• Verify inventory for affected versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in mooSocial up to 3.2.4. However, the vendor did not respond to the disclosure. Defenders should verify the accuracy of the provided information and assess the potential impact on their systems. The exploit has been publicly released, which increases the urgency for remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.