PT-2026-35153 · Star7Th · Showdoc

Liu Tingwei · Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-6982

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions star7th ShowDoc versions prior to 3.8.1

Description An issue exists in the API Page Sort Endpoint within the file server/Application/Api/Controller/PageController.class.PHP. A remote attacker can perform SQL injection—a technique where malicious SQL statements are inserted into entry fields for execution—by manipulating the pages argument.

Recommendations Upgrade to version 3.8.1.

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2026-6982

GHSA-FM5R-CJ7V-RJ2C

Affected Products

Showdoc

References · 10

• https://github.com/star7th/showdoc/releases/tag/v3.8.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6982 · Security Note
• https://osv.dev/vulnerability/GHSA-fm5r-cj7v-rj2c · Vendor Advisory
• https://github.com/star7th/showdoc · Note
• https://twitter.com/VulmonFeeds/status/2048064223347884092 · Twitter Post
• https://vuldb.com/vuln/359525 · Note
• https://twitter.com/CVEnew/status/2048099264572559568 · Twitter Post
• https://vuldb.com/submit/795528 · Note
• https://gist.github.com/saDL0w/555e19668264f98d96259ad47ea33811 · Note
• https://vuldb.com/vuln/359525/cti · Note