[MEDIUM] Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

PKSA-mg6n-7v6r-wbcq CVE-2026-92692 GHSA-jg26-q8hg-3pq4

Affected package: sulu/sulu

Affected version: >=3.0.0,<3.0.8|<2.6.25

Reported by:
GitHub