CVE-2026-54818

HighCVSS 8.5/10Last modified Oct 25, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection.

This issue affects Slimstat Analytics: from n/a through 5.4.11.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
VeronaLabsSlimstat Analytics<= 5.4.11

References

Timeline

Published
Jun 17, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-548199.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL CVE-2026-54829.3Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php eCVE-2026-548209.3Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.CVE-2026-548217.4Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.CVE-2026-548228.5Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.CVE-2026-548239.9Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.CVE-2026-548247.5Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.CVE-2026-548259.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows BCVE-2026-548267.6Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.CVE-2026-548279.3Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.CVE-2026-548287.5Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-548297.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus
CVE-2026-54818: High severity, CVSS 8.5 | Vulnix