First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-56062

CriticalCVSS 9.3/10Last modified Oct 25, 2026

Description

Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
oooorgle	Quotes llama	<= 3.1.5

References

https://patchstack.com/database/wordpress/plugin/quotes-llama/vulnerability/wordpress-quotes-llama-plugin-3-1-5-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-560638.3Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.CVE-2026-560648.5Subscriber SQL Injection in Tourfic <= 2.22.5 versions.CVE-2026-560657.5Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofind CVE-2026-560665.8Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-560679.3Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.CVE-2026-560689.3Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-560697.5Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.CVE-2026-56076.3A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the CVE-2026-560709.3Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-560717.1Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-560727.1Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-560739.4Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verificatio

CVE-2026-56062: Critical severity, CVSS 9.3 | Vulnix