PT-2026-6436 · Packagist · Aimeos/Aimeos-Laravel

Published 2026-01-15 · Updated 2026-01-15

OSV

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-HM9J-CGMM-2W36

Affected Products

Aimeos/Aimeos-Laravel

References · 6

• https://osv.dev/vulnerability/GHSA-hm9j-cgmm-2w36 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47763 · Security Note
• https://github.com/aimeos/aimeos-laravel · Note
• https://aimeos.org/laravel-ecommerce-package · Note
• https://exploit-db.com/exploits/50538 · Note
• https://aimeos.org · Note