CVE-2026-96604
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Risk Assessment
A remote attacker can execute arbitrary SQL queries, risking data leakage, modification, or deletion from the database.
Recommendation
Update DataLife Engine to a patched version, and if no vendor patch is available, consider deploying WAF rules that filter request parameters.
Other vulnerabilities in DataLife Engine
Original NVD description (English source)
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS