CVE-2026-65971
HIGH
NVD
CVSS Score
7.6
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
Livewire PowerGrid creates data tables based on Laravel Livewire library. From version 6.0.0 to before version 6.10.4, the public Livewire property sortDirection is interpolated verbatim into a raw SQL ORDER BY clause and is not restricted to asc/desc, allowing arbitrary SQL injection through POST /livewire/update. This issue has been patched in version 6.10.4.