CVE WatchSep 23, 2026

CVE-2026-96601

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin

CVSS

7.3

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 23, 2026 · Last modified: Sep 23, 2026 · CWE-74 · CWE-89

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-967517.3 HIG

—

———A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.5h CVE-2026-966047.3 HIG

—

———A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.7h CVE-2026-966027.3 HIG

—

———A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure.7h CVE-2026-968267.6 HIG

—

———Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.9h CVE-2026-956019.3 CRI

—

——0Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.9h CVE-2026-955937.6 HIG

—

——0Editor SQL Injection in Ultimeter <= 3.0.8 versions.9h