izhaorui CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH izhaorui CVE published 2026-10-16

CVE-2026-111669

ZR.Admin.NET through 3.8.2 contains an SQL injection vulnerability via the PagerInfo.Sort ORDER BY clause. Authenticated attackers with system:user:list permission can inject subqueries or CASE expressions to extract database contents, such as stored credentials, using blind techniques. This vulnerability allows attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parame [truncated]