SQL Injection Vulnerability in Isotope eCommerce by Isotope
CVE-2026-96600

7HIGH

Key Information:

Vendor

Isotope

Status
Isotope-core
Vendor
CVE Published:
23 September 2026

What is CVE-2026-96600?

The Isotope eCommerce platform, prior to version 2.9.10, contains a blind SQL injection vulnerability due to improper handling of user inputs in backend callbacks. This security flaw allows authenticated Contao backend users with Isotope module permissions to construct and execute conditional and time-based SQL injection payloads, enabling them to potentially access sensitive database information, including user password hashes from the tl_user table. Careful scrutiny of backend inputs and proper sanitization measures are crucial to mitigate this vulnerability.

Affected Version(s)

isotope-core 0 <= 2.9.10

References

https://github.com/isotope/core/issues/2585
issue-tracking
https://github.com/isotope/core
product
https://github.com/isotope/core/blob/028d47cbe69c7712339d...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ikram-4
.