What is GHSA-hm9j-cgmm-2w36?

GHSA-hm9j-cgmm-2w36 is a security advisory published by GitHub Security Advisories with High severity. Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Which CVE IDs does GHSA-hm9j-cgmm-2w36 cover?

GHSA-hm9j-cgmm-2w36 covers the following CVE IDs: CVE-2021-47763. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hm9j-cgmm-2w36?

GHSA-hm9j-cgmm-2w36 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-hm9j-cgmm-2w36?

GHSA-hm9j-cgmm-2w36 affects 1 product, including: composer/aimeos/aimeos-laravel:= 2021.10.

GHSA-hm9j-cgmm-2w36HighCVSS 8.2

Aimeos contains a SQL injection vulnerability in the json api 'sort' parameter

Vendor

GitHub Security Advisories

Published

January 15, 2026

Last Modified

January 15, 2026

🔗 CVE IDs covered (1)

CVE-2021-47763 →

📋 Description

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attackers can manipulate the sort parameter to reveal table and column names by sending crafted GET requests to the jsonapi/review endpoint.

🎯 Affected products1

composer/aimeos/aimeos-laravel:= 2021.10

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-47763
https://aimeos.org
https://aimeos.org/laravel-ecommerce-package
https://www.exploit-db.com/exploits/50538
https://github.com/advisories/GHSA-hm9j-cgmm-2w36