CVE-2026-87781

{
  "etk_id": "ETK-2026-1931",
  "cve_id": "CVE-2026-87781",
  "display_id": "CVE-2026-87781",
  "ghsa_id": "GHSA-wjc2-8p3x-27rg",
  "euvd_id": "EUVD-2026-96131",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in LTL Freight Quotes",
  "summary": "LTL Freight Quotes versions before 4.2.19 contain an SQL injection flaw in request parameter handling. An unauthenticated remote attacker may manipulate database queries when the vulnerable plugin is installed and reachable.",
  "mitigation": "Update LTL Freight Quotes to version 4.2.19 or later. Until updating, restrict public access to sites using the plugin where practical.",
  "vendor": null,
  "product": "LTL Freight Quotes",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.2.11, < 4.2.19"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.2.19"
      ],
      "package_name": "LTL Freight Quotes",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.6,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1697,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 42.05089473333334,
  "t0_at": "2026-10-10T06:00:09.901000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T05:24:41.105995+00:00",
      "days": 7.9753611689236115,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T06:00:09.901000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-10T06:00:09.901000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-10T06:00:09.901000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87781"
    }
  }
}