PT-2026-34664 · Unknown · Socialengine

Egidio Romano · Published 2026-04-23 · Updated 2026-04-27 · CVE-2026-41460

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SocialEngine versions 7.8.0 and prior

Description An issue exists in the '/activity/index/get-memberall' endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. This allows an unauthenticated remote attacker to read arbitrary data from the database, reset administrator account passwords, and gain unauthorized access to the Packages Manager in the Admin Panel, which could potentially enable remote code execution.

Recommendations Update SocialEngine to a version later than 7.8.0. Avoid using the text parameter in the '/activity/index/get-memberall' endpoint until the issue is resolved.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41460

Affected Products

Socialengine

References · 8

• 🔥 https://karmainsecurity.com/KIS-2026-08 · Exploit
• 🔥 https://karmainsecurity.com/pocs/CVE-2026-41460.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41460 · Security Note
• https://vulncheck.com/advisories/socialengine-sql-injection-via-activity-index-get-memberall · Note
• https://twitter.com/OrizonCyber/status/2047352327170867557 · Twitter Post
• https://t.me/cveNotify/161108 · Telegram Post
• http://seclists.org/fulldisclosure/2026/Apr/12 · Note
• https://socialengine.com · Note