Loading story…
Pixa Bank 2.0 was disclosed with a high-severity unauthenticated SQL injection vulnerability, tracked as CVE-2026-49491, in the agence-ajax.php API. The flaw affects the rib parameter and can be triggered with crafted POST requests, allowing attackers to perform UNION-based SQL injection against the backend database without logging in.
Successful exploitation can expose sensitive records including user names, email addresses, and phone numbers. The issue was classified as CWE-89 and assigned a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting low attack complexity and high confidentiality impact, with references published by VulnCheck and other security tracking sources.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
VulnCheck published an advisory describing an unauthenticated SQL injection vulnerability in Pixa Bank 2.0 via the agence-ajax.php API. The issue allows UNION-based SQL injection through the 'rib' parameter and may expose names, email addresses, and phone numbers.
The CVE record for an unauthenticated SQL injection in Pixa Bank 2.0 states it was received by disclosure@vulncheck.com. The flaw affects the 'rib' parameter in POST requests to agence-ajax.php and can expose sensitive database contents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026
A high-severity SQL injection vulnerability tracked as **`CVE-2017-20263`** affects **Joomla! Component FocalPoint Pro/Free 1.2.3**. Public disclosures show that unauthenticated attackers can send crafted `GET` requests to `index.php` using `option=com_focalpoint`, `view=location`, and a malicious `id` value to inject arbitrary SQL commands through the component’s location view. The flaw was originally publicly documented without a CVE and later cataloged as remotely exploitable with **CVSS 4.0 8.8** and **CVSS 3.1 8.2** ratings. Successful exploitation could expose sensitive information stored in the backend database and may allow broader abuse depending on database permissions. Published guidance recommends updating the affected component, sanitizing the vulnerable `id` parameter, using parameterized queries, and limiting database account privileges to reduce impact if exploitation occurs.
Jun 29, 2026