CVE-2026-56070

CriticalCVSS 9.3/10Last modified Oct 25, 2026

Description

Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-560717.1Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-560727.1Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.CVE-2026-560739.4Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verificatioCVE-2026-560745.5PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command CVE-2026-560758.8PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, ovCVE-2026-560768.1PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger CVE-2026-560776.5PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access CVE-2026-560788.8PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paCVE-2026-560796.5Capgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keysCVE-2026-56088.8A vulnerability was detected in Belkin F9K1122 1.00.33. Affected is the function formWlanSetup of the file /goform/formWlanSetup. The manipuCVE-2026-560804.9Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changeCVE-2026-560819.1Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email
CVE-2026-56070: Critical severity, CVSS 9.3 | Vulnix