First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-56064

HighCVSS 8.5/10Last modified Oct 25, 2026

Description

Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
Themefic	Tourfic	<= 2.22.5

References

https://patchstack.com/database/wordpress/plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Jun 26, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-560657.5Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofind CVE-2026-560665.8Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.CVE-2026-560679.3Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.CVE-2026-560689.3Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.CVE-2026-560697.5Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.CVE-2026-56076.3A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the CVE-2026-560709.3Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.CVE-2026-560717.1Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-560727.1Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-560739.4Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verificatio CVE-2026-560745.5PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command CVE-2026-560758.8PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, ov

CVE-2026-56064: High severity, CVSS 8.5 | Vulnix