{"affected":[{"product":"livewire-powergrid","source":"CNA: GitHub_M","vendor":"Power-Components","versions":[{"status":"affected","version":">= 6.0.0, < 6.10.4"}]}],"cveId":"CVE-2026-65971","cwes":["CWE-89"],"description":"Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"}],"modifiedAt":1794433752607,"publishedAt":1794433752607,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Power-Components/livewire-powergrid/security/advisories/GHSA-7fgc-3h6c-698r"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Power-Components/livewire-powergrid/commit/13d047bf1637e82926e6914aa3ca0f29a4c9704a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Power-Components/livewire-powergrid/releases/tag/v6.10.4"}],"remediation":[],"revision":"ad11c1b7b83b59f49eeea64286db77dff625e38b6a64e28e80a7b287d469e656","sources":[{"modifiedAt":1794433752607,"name":"CNA: GitHub_M","retrievedAt":1794435070997,"url":"https://www.cve.org/CVERecord?id=CVE-2026-65971"}],"ssvc":null,"status":"published","title":"Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path","updatedAt":1794435070997}