TI-2018-15656 CVE-2018-25431 · GHSA-v8w6-w2g8-mrffNo-Cms 1.0 SQL Injection via order_by ParameterPriority MEDIUM 64No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries.CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00273 · Published 2026-06-01 · No fix listed CWE-89