CVE-2026-94177
validatedZero produced an exploit or a check.GHSA-hm28-2mq5-c33m ↗EUVD-2026-89842 ↗
description
GamiPress releases through 8.0.2 are affected by a blind SQL injection flaw. An attacker may be able to influence database queries; the advisory describes access without authentication, although NVD metadata indicates low privileges may be required.
mitigation
Disable GamiPress or restrict access to the application endpoints that expose it to trusted users until an update is available. Apply a vendor-provided update promptly when one is published.
outcome
Check only, differential: the check fires on the vulnerable build and is silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-09-30 12:27Zcve.org record for CVE-2026-94177
- 2026-10-19vulncheck_kev: trigger signal, started the run
- 2026-10-19 00:00Z
this entry in the feed
GET /api/v1/feed/CVE-2026-94177
{ "etk_id": "ETK-2026-2068", "cve_id": "CVE-2026-94177", "display_id": "CVE-2026-94177", "ghsa_id": "GHSA-hm28-2mq5-c33m", "euvd_id": "EUVD-2026-89842", "status": "published", "anchor_state": "anchored", "title": "Blind SQL injection in GamiPress", "summary": "GamiPress releases through 8.0.2 are affected by a blind SQL injection flaw. An attacker may be able to influence database queries; the advisory describes access without authentication, although NVD metadata indicates low privileges may be required.", "mitigation": "Disable GamiPress or restrict access to the application endpoints that expose it to trusted users until an update is available. Apply a vendor-provided update promptly when one is published.", "vendor": "Ruben Garcia", "product": "GamiPress", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 8.0.2" ], "ecosystem": null, "fixed_versions": [], "package_name": "gamipress", "purl": null } ], "cwes": null, "cvss_score": 8.5, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L", "epss_score": 0.0026, "epss_percentile": 0.1668, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": false, "pipeline_minutes": 41.15040353333333, "t0_at": "2026-09-30T12:27:07.360000+00:00", "signals": { "check": { "at": "2026-10-19T17:33:21.199172+00:00", "days": 19.21266017560185, "is_lower_bound": false, "measured_at": "2026-09-30T12:27:07.360000+00:00", "url": null }, "kev": { "at": "2026-10-19T00:00:00+00:00", "days": 19, "is_lower_bound": false, "measured_at": "2026-09-30T12:27:07.360000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-94177" }, "trigger_signal": { "at": "2026-10-19T00:00:00+00:00", "days": 18.481164814814814, "is_lower_bound": false, "measured_at": "2026-09-30T12:27:07.360000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-94177" } } }
published 2026-10-19 16:52Z
last change 2026-10-21 02:54Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.