CVE-2023-39560
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk89th percentile - higher than 89% of all known CVEs
Summary
A SQL injection vulnerability was discovered in ECTouch v2 via the $arr['id'] parameter in the insert.php file. An attacker can exploit this flaw to execute unauthorized database queries.
Risk Assessment
The risk includes potential leakage of sensitive data, modification or deletion of database records, and possible privilege escalation within the system.
Recommendation
Immediately update ECTouch to the latest version and implement parameterized SQL queries or input validation for the id parameter.
Related vulnerabilities
- CVE-2026-79876Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79875Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79874Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79873Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79872Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79871Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79870Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79869Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79868Critical
No vulnerability description was provided in the supplied NVD data. Technical details and the affected component cannot be determined from the available information.
- CVE-2026-79867Critical
No vulnerability description is available in the NVD. The nature and scope of the issue cannot be determined from the provided data.
Original NVD description (English source)
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS