CVE-2026-108541— highwarden Super Store Finder index.php sql injection
Quick assessment
Affected
highwarden Super Store Finder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Highwarden Super Store Finder 最高至 3.8 版本中存在一个漏洞。受影响的文件 中某个未知函数存在安全问题。通过操控 / 参数，可导致 SQL 注入。攻击者可以从远程进行利用。该漏洞的利用代码已公开，可能被任何人使用。升级至 3.9 版本可解决此问题。建议受影响的组件尽快升级。供应商在漏洞早期阶段已被告知，并以非常专业的态度迅速发布了修复版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| highwarden | Super Store Finder | 3.0 |
affected |
3.1 |
affected | ||
3.2 |
affected | ||
3.3 |
affected | ||
3.4 |
affected | ||
3.5 |
affected | ||
3.6 |
affected | ||
3.7 |
affected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108541
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
highwarden Super Store Finder index.php sql injection
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| highwarden | Super Store Finder | 3.0 |
cpe:2.3:a:highwarden:super_store_finder:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108541
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108541
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Super Store Finder
-
CVE-2026-81768
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scr -
CVE-2025-58939
WordPress Super Store Finder plugin <= 7.5 - Cross Site Requ -
CVE-2025-47571
WordPress Super Store Finder plugin < 7.8 - Local File Inclu -
CVE-2025-49413
WordPress Super Store Finder Plugin <= 7.6 - Reflected Cross -
CVE-2025-52720
WordPress Super Store Finder Plugin <= 7.5 - SQL Injection V
Same vendor: highwarden
-
CVE-2026-81768
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scr -
CVE-2025-69054
WordPress Super Logos Showcase plugin <= 2.8 - Reflected Cro -
CVE-2025-49045
WordPress Super Interactive Maps plugin <= 2.3 - Reflected C -
CVE-2025-58939
WordPress Super Store Finder plugin <= 7.5 - Cross Site Requ -
CVE-2025-47571
WordPress Super Store Finder plugin < 7.8 - Local File Inclu
Same weakness: CWE-89
-
CVE-2026-105412
SQL Injection vulnerability affecting Tuleap Enterprise Edit -
CVE-2026-108826
Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injectio -
CVE-2026-108824
DataEase Utils.java Utils.buildCalcField sql injection -
CVE-2026-108821
Tencent WeKnora SQL Validator inject.go validateSubquery sql -
CVE-2026-1907
SQL Injection in Clustering Communication (Hybrid Mode)
V. Comments for CVE-2026-108541
No comments yet