Product
A time-based blind SQL injection vulnerability in Zabbix API (CVE-2026-23921) allows authenticated attackers to exfiltrate database data via malicious input to the sortfield and groupBy parameters.