# CVE-2026-54222: UBB Systems UBB.threads Blind SQL Injection in Members Control Panel

Source: https://junglewise.ai/threats/cve-2026-54222-ubb-systems-ubb-threads-blind-sql-injection-in-members-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-54222 · Severity: info · CVSS 8.6 · Published 2026-06-18

UBB.threads, a popular forum and community software, contains a security flaw in its administrative control panel. An attacker with administrative access to the member management section can use this flaw to bypass security controls and directly query the underlying database. This could allow them to steal sensitive information, including user credentials and private forum data.

Technologies: [UBB Systems UBB.threads](https://junglewise.ai/threats/technologies/ubb-threads). Vendors: [UBB Systems](https://junglewise.ai/threats/vendors/ubb-systems).

## Quick answers

**Is CVE-2026-54222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54222 being exploited in the wild.

**How severe is CVE-2026-54222?** Informational severity, with a CVSS score of 8.6, published 18 June 2026.

**Which products and versions are affected?** UBB Systems UBB.threads All versions through 7.7.5.

**Is there a fix for CVE-2026-54222?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54222 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54222?** Check whether you run UBB Systems UBB.threads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Blind SQL Injection vulnerability exists in UBB.threads through version 7.7.5 due to insufficient input sanitization within the 'Members' section of the Control Panel. An attacker with high privileges (access to the Control Panel) can manipulate SQL queries using time-based or boolean-based techniques to interact with the underlying database. This flaw allows for the extraction of sensitive data, such as user credentials. The vulnerability is confirmed in version 7.7.5, but other versions are likely affected as vendor contact attempts were unsuccessful and no patch is currently available.

## Affected products

- UBB Systems UBB.threads All versions through 7.7.5

## Timeline

- 2026-06-18: advisory: Advisory published by CERT.PL
- 2026-06-18: disclosed: Public disclosure via NVD

## References

- [https://cert.pl/en/posts/2026/06/CVE-2026-54219](https://cert.pl/en/posts/2026/06/CVE-2026-54219)
- [https://www.ubbcentral.com/](https://www.ubbcentral.com/)

## Related threats

- [UBB Systems UBB.threads Denial of Service via resource exhaustion](https://junglewise.ai/threats/cve-2026-54224-ubb-systems-ubb-threads-denial-of-service-via-resource-exhaustion)
- [UBB Systems UBB.threads Path Traversal in Template Editor](https://junglewise.ai/threats/cve-2026-54223-ubb-systems-ubb-threads-path-traversal-in-template-editor)
- [UBB Systems UBB.threads Reflected XSS](https://junglewise.ai/threats/cve-2026-54221-ubb-systems-ubb-threads-reflected-xss)
- [UBB Systems UBB.threads Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2026-54220-ubb-systems-ubb-threads-cross-site-request-forgery)
- [UBB Systems UBB.threads Stored XSS in posts and profile fields](https://junglewise.ai/threats/cve-2026-54219-ubb-systems-ubb-threads-stored-xss-in-posts-and-profile-fields)