CVE-2026-66668

HighCVSS 8.5/10Last modified Aug 20, 2026

Description

Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Aug 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-66674.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the aCVE-2026-666708.1Unauthenticated Local File Inclusion in Måne <= 1.7 versions.CVE-2026-666718.1Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.CVE-2026-666729.8Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.CVE-2026-666737.1Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.CVE-2026-666745.6Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-666765.3Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.CVE-2026-666777.6Subscriber Broken Authentication in Leyka <= 3.32.3 versions.CVE-2026-666784.3Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.CVE-2026-666796.5Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-66687.5Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial oCVE-2026-666809.3Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
CVE-2026-66668: High severity, CVSS 8.5 | Vulnix