Live › vulnerability › CVE-2026-115607
Go to dashboardCrowd Favorite DXP ToolKit (dxp-toolkit) fails to neutralize special SQL characters in input, so it allows SQL injection. An attacker can likely read or change database contents; the sources do not say which input path is affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Teams running Crowd Favorite DXP ToolKit dxp-toolkit version 2.0.1 or earlier. The sources do not say which deployment setups or input paths are exposed.
No product ranges from the sources yet.
dxp-toolkit package or plugin is installed and note its version.dxp-toolkit to a version later than 2.0.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115607")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.