CVE-2026-118192Published
JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
Exact source revision recorded 29 Oct 2026 10:47:50 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118192 · Microsoft / collected KEV context
cve-program · CVE-2026-118192
- https://www.wordfence.com/threat-intel/vulnerabilities/id/31931ac8-08f8-4fe7-9318-5a1d8dc89bed?source=cve
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/base/wordpress/classes/class-jsport-getplayers.php#L136
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/includes/joomsport-shortcodes.php#L485
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L39
- https://plugins.trac.wordpress.org/browser/joomsport-sports-league-results-management/tags/5.7.11/sportleague/classes/objects/class-jsport-team.php#L280
- https://plugins.trac.wordpress.org/changeset/3770486
- https://plugins.trac.wordpress.org/changeset/3770486/joomsport-sports-league-results-management/trunk/sportleague/base/wordpress/classes/class-jsport-getplayers.php
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.