CVE-2026-89180
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
Risk Assessment
An unauthenticated remote attacker can read arbitrary data from the database, potentially resulting in leakage of confidential information.
Recommendation
Update EFence to a version containing the fix or implement measures to restrict access to the application.
Other vulnerabilities in EFence
See all- CVE-2026-80235Critical
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- CVE-2026-80237High
EFence by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, enabling arbitrary code execution on the server.
- CVE-2026-80236High
Efence by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.
Original NVD description (English source)
EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS