CVE-2026-109688

{
  "etk_id": "ETK-2026-1683",
  "cve_id": "CVE-2026-109688",
  "display_id": "CVE-2026-109688",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102048",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Link Whisper Free",
  "summary": "Link Whisper Free versions up to and including 0.9.7 are affected by a blind SQL injection flaw. A remote attacker may be able to influence database queries without an account when the vulnerable plugin is installed and reachable.",
  "mitigation": "Disable Link Whisper Free on sites running version 0.9.7 or earlier until an updated release is available. If it cannot be removed immediately, restrict public access to the affected site and monitor for suspicious database activity.",
  "vendor": "Link Whisper INC",
  "product": "Link Whisper Free",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.9.7"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "link-whisper",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
  "epss_score": 0.0024,
  "epss_percentile": 0.1372,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 33.52864735,
  "t0_at": "2026-10-15T13:00:23.246000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T14:39:28.330450+00:00",
      "days": 0.06880884780092593,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T13:00:23.246000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T13:00:23.246000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T13:00:23.246000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109688"
    }
  }
}