CVE-2026-115607

CriticalCVSS 9.3

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

The Crowd Favorite DXP ToolKit plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This issue affects DXP ToolKit versions from n/a through 2.0.1.

Risk Assessment

An attacker could inject malicious SQL queries, potentially leading to disclosure, modification, or deletion of database data. This may compromise the confidentiality and integrity of the application's data.

Recommendation

Update the DXP ToolKit plugin to a version later than 2.0.1 that contains the fix. Consider deploying a WAF and auditing database logs for unusual queries.

Other vulnerabilities in DXP ToolKit

CVE-2026-115606High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows Stored XSS. This issue affects DXP ToolKit: from n/a through 2.0.1.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS