CVE-2026-96600

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

7.0 High

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.42%Up 0.2 points since Sep 24, 2026

What each source reports

CVE List Score used 7.0

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Record: CVE-2026-96600
CVSS 4.0: 7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2026-85341 7.0

Record: EUVD-2026-85341
CVSS 4.0: 7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7pjx-8r2g-hwpp 7.0

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend...

Record: GHSA-7pjx-8r2g-hwpp
CVSS 4.0: 7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-89
Updated: 2026-11-02

NVD 7.0

Record: CVE-2026-96600
CVSS 4.0: 7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-89
Updated: 2026-11-02

OSV 7.0

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Record: CVE-2026-96600
CVSS 4.0: 7.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

Affected products

isotope isotope-core

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-96600 is a high vulnerability (CVSS 7.0) in Isotope Isotope-core, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.