CVE-2026-56052

HighCVSS 7.6/10Last modified Jun 25, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection.

This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-560538.8Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.CVE-2026-560547.7Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.CVE-2026-560558.8Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.CVE-2026-560579.8Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.CVE-2026-560589.9Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.CVE-2026-560599.9Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.CVE-2026-56066.3A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the filCVE-2026-560607.5Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.CVE-2026-560617.5Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.CVE-2026-560629.3Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.CVE-2026-560638.3Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-560648.5Subscriber SQL Injection in Tourfic <= 2.22.5 versions.
CVE-2026-56052: High severity, CVSS 7.6 | Vulnix