CVE-2026-7002

HighCVSS 7.3/10Last modified Oct 26, 2026

Description

A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
KLiKSocialMediaWebsite1.0.0; 1.0.1

References

Timeline

Published
Apr 25, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-700217.0Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally.CVE-2026-700237.8Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2026-700249.8Stack-based buffer overflow in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.CVE-2026-700256.5Use after free in Windows Netlogon allows an authorized attacker to deny service over a network.CVE-2026-700267.0Use after free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2026-700277.8Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.CVE-2026-70035.3WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OACVE-2026-700317.5Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.CVE-2026-700337.5Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a CVE-2026-700358.8Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.CVE-2026-700388.1Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.CVE-2026-70046.1WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated at
CVE-2026-7002: High severity, CVSS 7.3 | Vulnix