CVE WATCH / VULNERABILITY DETAIL
CVE-2026-126374
MEDIUMCVSS 4.3NVD feed
Published 13 November 2026 · tracked since 14 November 2026
Description
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-126400 LOW 3.7
- CVE-2026-126384 HIGH 7.5
- CVE-2026-126383 HIGH 8.2
- CVE-2026-126381 MEDIUM 6.3
- CVE-2026-126380 CRITICAL 9.1
- CVE-2026-126378 CRITICAL 9.1
- CVE-2026-126377 HIGH 8.1
- CVE-2026-126372 HIGH 8.8
- CVE-2026-126370 HIGH 8.8
- CVE-2026-126323 MEDIUM 4.3