CVE-2026-58492— grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

AI Predicted 8.1 Difficulty: Easy Updated Jul 11, 2026

Possible ATT&CK Techniques 3AI

T1059 · Command and Scripting Interpreter T1005 · Data from Local System T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
getgrav	grav	`< 1.2.0`	affected

Updated Jul 11, 2026

Get alerts for future matching vulnerabilitiesLog in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

Source: NVD (National Vulnerability Database)

Vulnerability Description

grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: NVD (National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
getgrav	grav	< 1.2.0	-

II. Public POCs for CVE-2026-58492

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-58492

请登录查看更多情报信息。

Same Patch Batch · getgrav · 2026-07-10 · 10 CVEs total

CVE-2026-55885	6.8 MEDIUM	Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
CVE-2026-61450	6.5 MEDIUM	Grav before 2.0.2 Config Exfiltration via offsetGet Filter
CVE-2026-61455	6.5 MEDIUM	Grav before 2.0.1 Decompression Bomb via ZipArchiver
CVE-2026-55890	4.8 MEDIUM	Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style()
CVE-2026-61456	4.6 MEDIUM	Grav before 1.0.3 Stored XSS via SVG Upload API
CVE-2026-53653		Grav: Unauthenticated denial of service via unbounded image derivative dimensions
CVE-2026-58493		grav-plugin-database: DSN Parameter Injection via Unsanitized Configuration Values in Conn
CVE-2026-59193		Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
CVE-2026-59190		Grav Admin Plugin — IDOR Privilege Escalation via saveUser()

IV. Related Vulnerabilities

Same product: grav

Same vendor: getgrav

Same weakness: CWE-89

V. Comments for CVE-2026-58492

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-58492— grav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation

Possible ATT&CK Techniques 3AI

Affected Version Matrix 1

I. Basic Information for CVE-2026-58492

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-58492

III. Intelligence Information for CVE-2026-58492

Patches & Fixes for CVE-2026-58492 (1)

Vendor Advisories for CVE-2026-58492 (1)

Vendor Pages for CVE-2026-58492 (1)

Same Patch Batch · getgrav · 2026-07-10 · 10 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-58492

Leave a comment