ZeroDay Findings
Sign inSign up

Findings

CVE-2026-28226

Phishing Club is a phishing simulation and man-in-the-middle framework.

Published Feb 26, 2026 · updated Jun 17, 2026 · phishing.club phishing club

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown values are silently passed through , an authenticated attacker can inject SQL expressions into the clause. This issue was patched in v1.30.2 by validating the order-by column against an allowlist and clearing unknown mappings.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 26, 2026 · NIST NVD

    Detected

    Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown value

  2. Jun 17, 2026 · NIST NVD

    Updated

    Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenates the user-controlled sortBy value directly into the ORDER BY clause without allowlist validation. Because unknown value

Affected

  • cpe phishing.club/phishing clubversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-28226

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-28226

    Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the GetOrphaned recipient listing endpoint in versions prior to v1.30.2. The endpoint constructs a raw SQL query and concatenate

    nvd.nist.gov

References