CVE-2026-113381
7.3HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote unauthenticated attackers can extract or tamper with database records and potentially compromise the application. Exploits are publicly available and require only network access to the web instance.
Root cause
The Item::findUserItems function in oc-includes/osclass/model/Item.php fails to sanitize the sPattern parameter before passing it into a database query.
Affected systems
Osclass up to 8.3.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is available; block or sanitize requests containing malicious sPattern parameters at your reverse proxy/WAF, or temporarily restrict public access to the Osclass application.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.