Phishing Club
Approved changes feed: RSS · Atom
cpe:2.3:a:phishing.club:phishing_club:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Phishing.Club (f92a2c4e-3e7a-5cd7-b5e9-44dd2b7fb074) |
|---|---|
| Product | Phishing Club (f6873a43-1eba-5040-86b6-47320338242e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28226 |
vulnerable | 2026-06-08 07:55:15.030802 |
Phishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing
MEDIUM (6.5)
Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through `RemapOrderBy()`, an authenticated attacker can inject SQL expressions into the `ORDER BY` clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.
Published: 2026-02-26T22:43:05.629Z
Updated: 2026-02-27T18:18:06.714Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.