---
id: CVE-2026-105146
title: >-
  A vulnerability was found in Comsenz Discuz!
  X5.0-20260801/X5.0-20260820/X5.0-20260910
summary: >-
  A vulnerability was found in Comsenz Discuz!
  X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the
  function modmedalsubmit of the file
  upload/source/app/admin/child/medals/mod.php of the component Admin Medal
  Moderatio…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-74
  - CWE-89
vendor: Comsenz
product: Discuz!
affected:
  - Discuz! X5.0-20260801
  - Discuz! X5.0-20260820
  - Discuz! X5.0-20260910
published: '2026-10-04'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T15:04:52.637'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105146'
references:
  - url: 'https://vuldb.com/cve/CVE-2026-105146'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/945923'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413371'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/413371/cti'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/945923'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00244
epssPercentile: 0.15494
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-05T15:49:39.060771Z'
ingestedAt: '2026-10-04T10:57:52.586Z'
---

## Overview

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.