What’s Vulnerable › Vulnerabilities

CVE-2026-105146: Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection

• Severity: medium (CVSS 4.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-04 · updated 2026-10-06
• Weakness: CWE-74

Description

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• Comsenz Discuz!: X5.0-20260801, X5.0-20260820, X5.0-20260910

References

• https://vuldb.com/cve/CVE-2026-105146
• https://vuldb.com/submit/945923
• https://vuldb.com/vuln/413371
• https://vuldb.com/vuln/413371/cti
• https://vuldb.com/submit/945923

Get alerted when CVE-2026-105146 or the next vulnerability affects your stack