CVE-2026-65707
Last modified
CVE-2026-65707 is a high-severity vulnerability rated 8.5/10 on the CVSS scale. Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| likeadmin-likeshop | likeshop | <= 3.0.5 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-65707?
How severe is CVE-2026-65707?
How do I fix CVE-2026-65707?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-65701SoftVC VITS Singing Voice Conversion through commit 730930d …9.3
- CVE-2026-65702Vanna through 2.0.2 contains a path traversal vulnerability …8.6
- CVE-2026-65703FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds w…8.5
- CVE-2026-65704FFmpeg through 8.1.2 contains an out-of-bounds write vulnera…7.8
- CVE-2026-65705FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds w…7.8
- CVE-2026-65706FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds w…8.5
- CVE-2026-65708sysPass through version 3.2.11 contains an insecure direct o…8.6
- CVE-2026-65709sysPass through version 3.2.11 contains a missing object-lev…8.7
- CVE-2026-6571A weakness has been identified in kodcloud KodExplorer up to…6.3
- CVE-2026-65710sysPass through version 3.2.11 contains a missing authorizat…7.1
- CVE-2026-65711sysPass through version 3.2.11 contains an OS command inject…8.6
- CVE-2026-65712Joomla Extension - regularlabs.com - Insecure path handling …6.2
Are you affected by CVE-2026-65707?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST