Phishingclub
Approved changes feed: RSS · Atom
cpe:2.3:a:phishingclub:phishingclub:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Phishingclub (63206af0-5021-5207-a37d-4d8deb6e9f7c) |
|---|---|
| Product | Phishingclub (c782156f-a93a-586d-baa7-8fb7d745d419) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28226 |
vulnerable | 2026-06-08 07:55:15.030199 |
Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing
MEDIUM (6.5)
Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.
Published: 2026-02-26T22:43:05.629Z
Updated: 2026-02-27T18:18:06.714Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.