CVE-2026-96600
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled ident
CVSS
5.5
Medium
EPSS
0.2%
p15
KEV
—
Exploit Today
5
0-100
Published: Sep 23, 2026 · Last modified: Sep 24, 2026 · CWE-89
0.2%EPSS · 30 days0.2%
2026-09-242026-10-19
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.
- github.comhttps://github.com/isotope/core
- github.comhttps://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188
- github.comhttps://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38
- github.comhttps://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200
- github.comhttps://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468
- github.comhttps://github.com/isotope/core/issues/2585
- www.vulncheck.comhttps://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-108087——
———** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions.
Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.10hCVE-2026-1133817.3 HIG—
———A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.7hCVE-2026-112238——
———The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.11hCVE-2026-112064——
———The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.11hCVE-2026-1134078.8 HIG—
——0BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.13hCVE-2026-1134068.8 HIG—
——0BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.13h