How do I check whether I am affected by CVE-2026-110895?

- Check the installed Support Genix Lite version in the plugin list or the plugin's main file header against the fixed release; the affected range is through `1.4.54` - Search the codebase or plugin folder for the vendor name 'DevItems' or the slug `support-genix-lite` to confirm it is installed - unknown whether the sources list a specific vulnerable endpoint

What is the fix for CVE-2026-110895?

- Update Support Genix Lite to a version later than `1.4.54`, as published by the vendor (fixed version number not stated in the sources) - If no fix is available, disable or remove the plugin until it is patched - unknown whether the sources name a specific patched version

Who is not affected by CVE-2026-110895?

Not affected if: not-installed.

Live › vulnerability › CVE-2026-110895

Go to dashboard

high8.5Package

Support Genix Lite: SQL injection lets attackers read or change database

Support Genix Lite, a support ticket plugin from DevItems, does not neutralize SQL input, so an attacker can inject SQL commands. The sources do not say which input is affected, but a successful injection can expose or alter the site's database.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.5

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or alters database contents through injected SQL.
CVSS said: 8.5. The facts above agree.

Who is affected

Sites or applications that run Support Genix Lite at version or earlier are affected. The sources do not say which request paths or settings expose the injection, so any installation of the plugin should be treated as exposed until updated. Teams that do not run this product can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-110895

Go to dashboard

high8.5Package

Support Genix Lite: SQL injection lets attackers read or change database

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.5

high

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or alters database contents through injected SQL.
CVSS said: 8.5. The facts above agree.

Who is affected

Know the next one before it finds you.

Add to Slack

Support Genix Lite: SQL injection lets attackers read or change database

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

Support Genix Lite: SQL injection lets attackers read or change database

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources