CVE-2026-118871 MEDIUM

CVE-2026-118871: SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product

Vendor Zte
Product ElasticNet RNIA R18 NGI
Weakness CWE-89 · SQLi
Published November 2, 2026
Last update November 2, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.

Key dates

02Disclosure timeline

November 2, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2026-32564 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - SQL Injection vulnerability CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter CVE-2026-73346 WordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability CVE-2026-32551 WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability CVE-2026-16586 Contest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'