CVE-2026-118871

MediumCVSS 6.5/10Last modified Nov 2, 2026

Description

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ZTEElasticNet RNIA R18 NGINGIV16.26.11SP04 and earlier versions

References

Timeline

Published
Nov 2, 2026
Last modified
Nov 2, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-118887.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosuCVE-2026-118896.5SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allCVE-2026-11896.4The LeadBI Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter of the 'leadbiCVE-2026-118904.3Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieveCVE-2026-1189048.1IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authenticCVE-2026-1189057.0Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nCVE-2026-118915.1Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-priCVE-2026-118935.9The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, vCVE-2026-1189388.8In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is rCVE-2026-118945.9The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api bCVE-2026-1189474.3A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's CVE-2026-118956.4The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi