TOKO-ONLINE-ROTI vulnerabilities
4 known CVE vulnerabilities in TOKO-ONLINE-ROTI, translated and rated.
- CVE-2026-15909Medium
A vulnerability was found in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 in an unknown function of the file proses/add.php. Manipulation of the argument kd_cs leads to authorization bypass. The attack can be carried out remotely.
- CVE-2026-15491High
A missing authentication vulnerability has been found in an unknown part of TOKO-ONLINE-ROTI up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The flaw can be exploited remotely without authentication.
- CVE-2026-15490High
A security flaw has been discovered in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The vulnerability is an SQL injection in the proses/add.php file, where the kode_produk or kd_cs arguments can be manipulated remotely. The exploit has been publicly released and may be used in attacks.
- CVE-2026-15489High
A SQL injection vulnerability exists in the proses/login.php file of TOKO-ONLINE-ROTI (up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99) via the Username argument. Remote exploitation is possible and a public exploit is available.