CVE-2026-111866
7.3HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the database. This allows reading, modifying, or deleting application data over the network.
Root cause
Improper input sanitization in the cache, del_cache, and arr2sql functions within func.php leads to SQL injection.
Affected systems
nemoTyrant manong commit 7c9e5228e133b9267ad3a415833bc9bb53193bb4 and earlier (rolling release model).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Pull the latest master commit from the nemoTyrant manong repository, or restrict network access to the application until func.php can be audited manually since no specific fix commit has been identified.
$ git pull origin masterAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The reported GitHub issue was closed with the reason "completed". However, it was not possible to determine the PR or commit which could have fixed this issue.