CVE-2026-94836
SQL injection in the tag bulk-action handler
| CVE | CVE-2026-94836 |
|---|---|
| Status | RESERVED |
| Product | SubMgr |
| Affected | all versions through 3.42 |
| Fixed | commit 658d46c8 (inc_login.php:572) |
| CWE | CWE-89 |
| CVSS 3.1 | 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) — researcher-assigned |
| Discoverer | David Kutz-Marks (@davidkm-ai) |
| Full chain write-up | chains/SUBMGR.md |
Detail
inc_login.php:572 implodes $_POST['tag'][] directly into an IN() clause with no escaping: tag[]=1) UNION SELECT password,2,email,4,5 FROM contacts--.
A second unsanitized implode() at :579 consumes values derived from the first query and is not independently exploitable.
Remediation
See chains/SUBMGR.md for the full remediation section, including operator
hardening that applies regardless of version.
References
- Chain write-up:
chains/SUBMGR.md - Machine-readable record: github.com/davidkm-ai/advisories/blob/main/CVE-2026-94836.md
Want this depth on your own systems?
DKM Security does the same work against client infrastructure, under scope and under contract.
Get In Touch