CVE-2026-8129

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file wishlist.php. Executing a manipulation of the argument delwlistid can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-812907.1Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.CVE-2026-812917.1Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.CVE-2026-812927.1Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions.CVE-2026-812939.3Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.CVE-2026-812949.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.CVE-2026-812957.1Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.CVE-2026-812967.5Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-812977.5Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-812987.1Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.CVE-2026-812994.3Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.CVE-2026-81307.3A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. TCVE-2026-813007.1Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.
CVE-2026-8129: High severity, CVSS 7.3 | Vulnix