{"id":"CVE-2026-88395","published":"2026-10-05T16:17:16.957","lastModified":"2026-10-06T16:08:43.180","description":"GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","tags":[]},{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","tags":[]},{"url":"https://github.com/fangtang7/CVE/blob/main/GouGuOA/sql.md","tags":[]}],"hasPoc":true,"ai":{"summary":"GouGuOA v6.0.5 and earlier versions are vulnerable to SQL Injection through the keywords parameter in the /home/message/rubbish endpoint, allowing attackers to execute arbitrary SQL commands and potentially gain full control over the database.","exploitability":"Exploitation is relatively straightforward as the flaw can be triggered via a crafted input to the keywords parameter. Precondition is that the application is running and accessible over the network.","blast_radius":"If exploited, the impact could be severe, as it allows full control over the database, potentially leading to data theft, corruption, or denial of service.","remediation":"Upgrade to GouGuOA v6.0.6 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","rce"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:44:33.121Z"}}