Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-61518: ISPConfig Remote API SQL Injection in Delete and Update Methods
CVE-2026-61518 · published 2 months ago
Summary
ISPConfig's Remote API has a security flaw that allows authorized users to access sensitive data or delete information. This affects users with any level of permission in the control panel. To protect your system, update ISPConfig to the latest version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ispconfig | ispconfig3 | <= * |
Original advisory text
ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not block quote-free boolean payloads and does not reject requests in its default configuration. A remote API user holding any single low-privilege function permission can inject arbitrary SQL to delete or modify records across all tenants in the control panel database and extract arbitrary data via blind boolean inference, including password hashes and client records.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.7
High
Type
CWE-89SQL Injection
Timeline
Published19 Aug 2026
Updated4 Nov 2026
First seen19 Aug 2026
Track software like this
Free during beta