CVE-2026-11480

MediumCVSS 6.3

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In BeikeShop up to version 1.6.0.22, an SQL injection vulnerability was found in the file beike/Admin/Routes/admin.php within the Admin Design Builder Endpoint. Manipulating the settings.value argument allows remote attack. The exploit is publicly available.

Risk Assessment

An attacker can remotely manipulate the database, potentially leading to leakage or modification of sensitive data.

Recommendation

Apply the patch with ID 2fa9805411088069fcc3b0c15b2f1f33d6e09958 immediately.

Other vulnerabilities in BeikeShop

CVE-2026-11462High
BeikeShop up to version 1.6.0.22 has an improper authorization vulnerability in the Stripe Plugin component in StripeController.php via the Request argument. The attack can be performed remotely, and the exploit is publicly available. A patch is available at commit 6719e0fc.

Original NVD description (English source)

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.