CVE-2026-108065

{
  "etk_id": "ETK-2026-1578",
  "cve_id": "CVE-2026-108065",
  "display_id": "CVE-2026-108065",
  "ghsa_id": "GHSA-gjqg-f9ch-24cr",
  "euvd_id": "EUVD-2026-101025",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in WebAlliance eCommerce",
  "summary": "Channel Software WebAlliance eCommerce exposes an SQL injection flaw in the SOAP GetUser method of its preapproval.asmx endpoint. An unauthenticated remote attacker may read or alter backend Microsoft SQL Server data and could potentially execute database-server commands if the endpoint is reachable.",
  "mitigation": "Restrict network access to the preapproval.asmx endpoint to trusted clients and disable it if it is not required. Apply a vendor-provided update when available; the advisory does not record a fixed version.",
  "vendor": "Channel Software",
  "product": "WebAlliance eCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.*"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WebAlliance eCommerce",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0077,
  "epss_percentile": 0.5471,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.398048383333332,
  "t0_at": "2026-10-14T13:38:03.563000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-14T13:38:03.563000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T13:38:03.563000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-108065"
    }
  }
}