{"id":"CVE-2026-52630","details":"SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php","modified":"2026-10-21T02:30:33.484600723Z","published":"2026-09-11T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52630.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://www.woltlab.com/community/thread/318621-aktualisierung-woltlab-suite-6-2-5-6-1-22-6-0-26-5-5-26/"},{"type":"WEB","url":"https://www.woltlab.com/de/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52630.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52630"},{"type":"PACKAGE","url":"https://github.com/WoltLab/WCF"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/woltlab/wcf","events":[{"introduced":"0"},{"last_affected":"56fba016f0f14978e50131e54e6831c69227fd4a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"6.2.4"}],"source":"DESCRIPTION"}]}}],"versions":["6.2.4","6.2.4_dev_1","6.2.3","6.2.3_dev_3","6.2.3_dev_2","6.2.3_dev_1","6.2.2","6.2.1","6.2.1_dev_2","6.2.1_dev_1","6.2.0","6.2.0_RC_4","6.2.0_RC_2","6.2.0_RC_1","6.2.0_Beta_5","6.2.0_Beta_4","6.2.0_Beta_2","6.2.0_Beta_1","6.2.0_Alpha_4","6.2.0_Alpha_3","6.2.0_Alpha_1","6.1.0_RC_1","6.1.0_Beta_2","6.1.0_Beta_1","6.1.0_Alpha_3","6.1.0_Alpha_2","6.1.0_Alpha_1","6.0.0_RC_1","6.0.0_Beta_4","6.0.0_Beta_3","6.0.0_Beta_2","6.0.0_Beta_1","6.0.0_Alpha_8","6.0.0_Alpha_7","6.0.0_Alpha_5","6.0.0_Alpha_4","6.0.0_Alpha_3","6.0.0_Alpha_2","6.0.0_Alpha_1","5.5.0_Beta_1","5.5.0_Alpha_6","5.5.0_Alpha_5","5.5.0_Alpha_4","5.5.0_Alpha_3","5.5.0_Alpha_2","5.5.0_Alpha_1","5.4.0_Beta_1","5.4.0_Alpha_3","5.4.0_Alpha_2","5.4.0_Alpha_1","5.3.0_RC_2","5.3.0_RC_1","5.3.0_Beta_2","5.3.0_Beta_1","5.2.2","5.2.1","5.2.0","5.2.0_RC_2","5.2.0_RC_1","5.2.0_Beta_4","5.2.0_Beta_3","5.2.0_Beta_2","5.2.0_Alpha_3","5.2.0_Alpha_2","5.2.0_Alpha_1","3.1.0_Beta_5","3.1.0_Beta_4","3.1.0_Beta_3","3.1.0_Beta_2","3.1.0_Beta_1","3.1.0_Alpha_4","3.1.0_Alpha_3","3.1.0_Alpha_2","3.1.0_Alpha_1","3.0.2_pl_2","3.0.2","3.0.1_pl_1","3.0.1","3.0.0","3.0.0_RC_4","3.0.0_RC_3","3.0.0_RC_2","3.0.0_RC_1","3.0.0_Beta_5","3.0.0_Beta_4","3.0.0_Beta_3","2.1.11","2.1.10","2.1.9_pl_1","2.1.9","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2_pl_1","2.1.2","2.1.1","2.1.0","2.1.0_RC_2","2.1.0_RC_1","2.1.0_Beta_4","2.1.0_Beta_2","2.1.0_Beta_1","2.0.4_pl_1","2.0.4","2.0.2","2.0.1","2.0.0","2.0.0_Beta_10","2.0.0_Beta_9","2.0.0_Beta_8","2.0.0_Beta_6","2.0.0_Beta_4","2.0.0_Beta_3","2.0.0_Beta_2","2.0.0_Beta_1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52630.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}