CVE-2021-44350: ThinkPHP

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.

Affected products

• ThinkPHP ThinkPHP: from 5.0.0, up to and including 5.1.22

Published 2021-12-15. Last modified 2026-06-17.