CVE-2026-96600
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.
Risk Assessment
The risk includes theft of user passwords and other sensitive data from the database, potentially leading to account takeover and system compromise.
Recommendation
Update Isotope eCommerce to a patched version and implement parameterized SQL queries in backend callbacks.
Other vulnerabilities in Isotope eCommerce
Original NVD description (English source)
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS