CVE-2026-65707

MediumCVSS 6.5

Published: 24/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability in the adjustAccount endpoint, allowing admin-level users to extract arbitrary database contents via unsanitized POST parameters.

Risk Assessment

Risk of full database compromise, including credentials, PII, and session tokens, potentially leading to complete system takeover.

Recommendation

Update Likeshop to version 3.0.6 or later, which includes parameter validation fixes.

Other vulnerabilities in Likeshop

CVE-2026-111348Medium
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

Original NVD description (English source)

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS