{"cve":"CVE-2026-96600","enrichment":{"created":"2026-09-23T16:45:03.392617+00:00","updated":"2026-09-23T16:45:03.392623+00:00","vendors":[]},"mitre":{"cpes":[],"created":"2026-09-23T14:52:13.073000+00:00","description":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},"cvssV4_0":{"score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}},"mitre_repo_path":"cves/2026/96xxx/CVE-2026-96600.json","references":["https://github.com/isotope/core","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468","https://github.com/isotope/core/issues/2585","https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks"],"title":"Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks","updated":"2026-09-23T16:03:27.808000+00:00","vendors":[],"weaknesses":["CWE-89"]},"nvd":{"cpes":[],"created":"2026-09-23T15:17:33.400000+00:00","description":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},"cvssV4_0":{"score":7.0,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-96600.json","references":["https://github.com/isotope/core","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468","https://github.com/isotope/core/issues/2585","https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks"],"title":null,"updated":"2026-09-23T17:17:23.053000+00:00","vendors":[],"weaknesses":["CWE-89"]},"opencve":{"changes":[{"created":"2026-09-23T15:00:00+00:00","data":[{"details":{"new":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.","old":null},"type":"description"},{"details":{"new":"Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks","old":null},"type":"title"},{"details":{"added":["CWE-89"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/isotope/core","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468","https://github.com/isotope/core/issues/2585","https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},"cvssV4_0":{"score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"d8d75295-cf09-42c4-bc3b-69874903669d"},{"created":"2026-09-23T16:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"be04c2a2-c323-4caa-a373-c3ffac7d92b1"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-09-23T14:52:13.073000+00:00","provider":"mitre"},"description":{"data":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":5.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{"score":7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"},"provider":"mitre"},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/isotope/core","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200","https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468","https://github.com/isotope/core/issues/2585","https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks"],"providers":["mitre","nvd"]},"title":{"data":"Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks","provider":"mitre"},"updated":{"data":"2026-09-23T16:03:27.808000+00:00","provider":"mitre"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-89"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-09-23T14:52:13.073000+00:00","description":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks","updated":"2026-09-23T16:03:24.152000+00:00","vendors":[],"vulnrichment_repo_path":"2026/96xxx/CVE-2026-96600.json","weaknesses":[]}}