CVE-2026-81567

HighCVSS 8.7/10Last modified Sep 16, 2026

Description

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content (e.g. customer records, order data, stored credentials/tokens) via boolean- or time-based inference, reachable on any public storefront that exposes the standard product listing or product-tags filter.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-815688.7Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreMode CVE-2026-815694.3An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to CVE-2026-81578.8The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its CVE-2026-815714.8The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shor CVE-2026-815727.8In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictabl CVE-2026-815738.6If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network- origin rest CVE-2026-815748.2In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to in CVE-2026-815757.5If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length CVE-2026-815767.7If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically CVE-2026-815789.8An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, u CVE-2026-815798.8In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows CVE-2026-81585.3The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exc