CVE-2026-63106

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

August 10, 2026

Last Seen

August 11, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical SQL Injection Vulnerability Discovered in ReadyEcommerce (CVE-2026-63106)78.0

A critical unauthenticated SQL injection vulnerability, CVE-2026-63106, has been identified in ReadyEcommerce versions prior to 4.5.2. The flaw exists in the product listing API, where the rating parameter is unsanitized and directly concatenated into a MySQL HAVING clause in ProductController.php....

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical SQL Injection Vulnerability Discovered in ReadyEcommerce (CVE-2026-63106)

Aug 11·1 sources

Related Articles (2)

CVE-2026-63106 TheHackerWire / 14h Attack Vector How the vulnerability can be exploited Network ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php.

www.thehackerwire.com·Aug 11

CVE-2026-63106 - Exploits & Severity

Related Entities

Sql Injection CVE-2026-66738 CWE-89 - SQL Injection T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter MySQL