Loading story…
CERT Polska reported two SQL injection vulnerabilities in the Alior Bank “raty” installment-payment module for PrestaShop. The issues are tracked as CVE-2026-7848 and CVE-2026-15600.
The available disclosures do not identify affected module versions, vulnerable request parameters, severity ratings, evidence of exploitation, or remediation measures. Organizations using the module should identify deployed versions and consult Alior Bank and CERT Polska advisories for fixes or mitigations.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-7848 was detailed as an SQL injection in the Alior Bank PrestaShop raty module's product and category update/addition hooks, where several promotion and category POST parameters are inserted into SQL UPDATE queries without validation. Exploitation requires relevant PrestaShop back-office edit access; the issue was fixed in module versions 9.0.7 and 8.1.11.
CVE-2026-15600 was detailed as an SQL injection flaw in the Alior Bank PrestaShop raty module's toggleCategoryPromotionAction method, where the status POST parameter is inserted into UPDATE queries without validation. An attacker with product or category add/edit access in the PrestaShop back office could inject SQL to access or modify database contents.
CERT Polska received a report of two SQL injection vulnerabilities in the Alior Bank “raty” module for PrestaShop, identified as CVE-2026-7848 and CVE-2026-15600.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cert.pl
Open sourcemalware.news
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two SQL injection vulnerabilities have been disclosed in legacy shopping cart software, affecting **KomSeo Cart 1.3** and **PilusCart 1.4.1**. The KomSeo Cart issue, tracked as `CVE-2018-25206`, affects the `my_item_search` parameter in `edit.php`, where crafted `POST` requests can trigger **boolean-based blind** or **error-based** SQL injection and expose sensitive database contents. The PilusCart flaw, tracked as `CVE-2019-25672`, affects the `send` parameter in a comment submission endpoint and allows unauthenticated attackers to perform **RLIKE-based boolean SQL injection** through `POST` requests. Both CVEs are classified as **CWE-89: Improper Neutralization of Special Elements used in an SQL Command** and were published with **CVSS v3.1** and **CVSS v4.0** scoring metadata. The records link to public references including **Exploit-DB**, **VulnCheck**, and project or vendor-related sources, indicating that exploit details and technical validation are available. Organizations still running either cart platform should treat the flaws as database-compromise risks because successful exploitation could allow attackers to extract sensitive information without authentication.
Jun 29, 2026
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: **SourceCodester Payroll Management and Information System v1.0** and **CodeAstro Simple Attendance Management System v1.0**. The SourceCodester issue, tracked as `CVE-2026-37347`, affects `/payroll/view_employee.php` and is classified as `CWE-89`; its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity. The CodeAstro flaw, `CVE-2026-37749`, is also a `CWE-89` SQL injection bug and affects `index.php`, where the `username` parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
Jun 29, 2026
A critical SQL injection flaw tracked as **`CVE-2026-12076`** has been disclosed in **Raytha CMS**, with confirmed impact on version **1.5.2**. The vulnerability resides in the platform’s **OData filter parsing pipeline** and allows a remote, unauthenticated attacker to execute arbitrary SQL statements against the underlying **PostgreSQL** database. Successful exploitation could lead to full database compromise, including extraction of stored credentials and other sensitive data. The issue has been rated **CVSS 4.0 9.3 (Critical)** and is considered remotely exploitable. **CERT Polska** coordinated disclosure and credited **Arkadiusz Marta** for the report, but said attempts to contact the vendor were unsuccessful, leaving uncertainty over whether additional versions are affected. Published guidance recommends upgrading to a patched release when available, applying SQL injection defenses, restricting database privileges, and monitoring database logs for suspicious activity.
Jun 30, 2026