Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce

T1Covered by 1 source · first reported by Rapid7 at 14 Oct, 12:47 UTC

Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065, an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or…