CVE-2026-51946

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints

Published 2026-07-01. Last modified 2026-07-02.