SQL Injection in Razinsoft Ready Ecommerce
CVE-2026-63106
ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (22.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Razinsoft Ready Ecommerce — versions 0
Weakness classification (CWE)
References
- codecanyon.net/item/ready-ecommerce-complete-multi-vendor-ecommerce-mobile-app-… (release-notes, product)
- www.vulncheck.com/advisories/readyecommerce-unauthenticated-sql-injection-via-p… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-63106?
- CVE-2026-63106 is a critical-severity vulnerability in Razinsoft Ready Ecommerce, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-08-10.
- How severe is CVE-2026-63106?
- Critical severity. CVSS v3 base score is 9.8 out of 10.