{"id":"CVE-2026-110895","kind":"vulnerability","aliases":["CVE-2026-110895"],"related":[],"title":"Support Genix Lite: SQL injection lets attackers read or change database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54.","summary":"Support Genix Lite, a support ticket plugin from DevItems, does not neutralize SQL input, so an attacker can inject SQL commands. The sources do not say which input is affected, but a successful injection can expose or alter the site's database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devitems","package","php","support-genix-lite","wordpress"],"not_affected_if":["not-installed"],"how_to_check":"- Check the installed Support Genix Lite version in the plugin list or the plugin's main file header against the fixed release; the affected range is through `1.4.54`\n- Search the codebase or plugin folder for the vendor name 'DevItems' or the slug `support-genix-lite` to confirm it is installed\n- unknown whether the sources list a specific vulnerable endpoint","fix":"- Update Support Genix Lite to a version later than `1.4.54`, as published by the vendor (fixed version number not stated in the sources)\n- If no fix is available, disable or remove the plugin until it is patched\n- unknown whether the sources name a specific patched version","status":"open","published_at":"2026-10-18T11:16:37+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:00:35+00:00","updated_at":"2026-10-25T03:00:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:00:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update Support Genix Lite to a version later than `1.4.54`, as published by the vendor (fixed version number not stated in the sources)\n- If no fix is available, disable or remove the plugin until it is patched\n- unknown whether the sources name a specific patched version","reach":"internet","title":"Support Genix Lite: SQL injection lets attackers read or change database","impact":"high","summary":"Support Genix Lite, a support ticket plugin from DevItems, does not neutralize SQL input, so an attacker can inject SQL commands. The sources do not say which input is affected, but a successful injection can expose or alter the site's database.","category":"package","nicknames":[],"who_cares":["support-genix-lite","wordpress","php","devitems"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads or alters database contents through injected SQL","analyst_note":"Check the NVD entry and the DevItems vendor page for the fixed version, the vulnerable endpoint and whether authentication is required.","how_to_check":"- Check the installed Support Genix Lite version in the plugin list or the plugin's main file header against the fixed release; the affected range is through `1.4.54`\n- Search the codebase or plugin folder for the vendor name 'DevItems' or the slug `support-genix-lite` to confirm it is installed\n- unknown whether the sources list a specific vulnerable endpoint","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Sites or applications that run Support Genix Lite at version `1.4.54` or earlier are affected. The sources do not say which request paths or settings expose the injection, so any installation of the plugin should be treated as exposed until updated. Teams that do not run this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3306,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110895':14A,17A '-2026':13A,16A '1.4.54':99C 'affect':55B,93C 'allow':89C 'alter':63B 'attack':7A,42B 'chang':10A 'command':46B,77C 'cve':12A,15A 'databas':11A,67B 'devitem':18B,34B,82C 'element':72C 'expos':61B 'genix':2A,23B,27B,84C,87C,95C 'improp':68C 'inject':5A,44B,59B,79C 'injection.this':91C 'input':39B,53B 'issu':92C 'let':6A 'lite':3A,24B,28B,88C 'n/a':97C 'neutral':37B,69C 'packag':19B 'php':20B 'plugin':32B 'read':8A 'say':51B 'site':65B 'sourc':48B 'special':71C 'sql':4A,38B,45B,76C,78C,90C 'success':58B 'support':1A,22B,26B,30B,83C,86C,94C 'support-genix-lit':21B,85C 'ticket':31B 'use':73C 'vulner':80C 'wordpress':25B","nicknames":[],"mitigations":[],"who_affected":"Sites or applications that run Support Genix Lite at version `1.4.54` or earlier are affected. The sources do not say which request paths or settings expose the injection, so any installation of the plugin should be treated as exposed until updated. Teams that do not run this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110895","severity":null,"published_at":"2026-10-18T11:16:37+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}