Skip to main content

Efence CVE-2026-80236

| EUVDEUVD-2026-66345 HIGH
SQL Injection (CWE-89)
2026-08-26 twcert GHSA-365q-7r89-28jh
SQLi File Upload Efence
8.8
CVSS 4.0 · Vendor: twcert
Share

Severity by source

Vendor (twcert) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network-reachable, unauthenticated, no user interaction; high confidentiality loss from full DB read, low integrity from file upload side-effect, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Aug 26, 2026 - 16:03 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 26, 2026 - 15:52 vuln.today
cvss_changed
CVSS changed
Aug 26, 2026 - 15:52 NVD
8.2 (HIGH) 8.8 (HIGH)
Analysis Generated
Aug 26, 2026 - 09:22 vuln.today
CVE Published
Aug 26, 2026 - 08:27 cve.org
HIGH 8.2

DescriptionCVE.org

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.

AnalysisAI

SQL injection in Thinking Software Technology's Efence (versions ≤ 1.2.66 DB Ver:56) exposes full database contents to unauthenticated remote attackers via the file upload functionality. The CVSS 4.0 score of 8.8 with PR:N and AV:N confirms no credentials are required, and SSVC rates the attack as automatable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Discover internet-facing Efence instance
Delivery
Send crafted HTTP request to file upload endpoint
Exploit
Inject SQL payload in upload parameter
Execution
Enumerate database schema
Impact
Extract database contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required - the CVSS 4.0 vector confirms PR:N and the description explicitly states 'unauthenticated remote attackers can access file upload functionality.' Exploitation requires only network access to the Efence file upload endpoint over HTTP/HTTPS. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N reflects a high-severity, network-reachable, unauthenticated attack requiring no user interaction and minimal complexity - a strong real-world risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker discovers an internet-facing Efence instance via passive DNS or banner scanning, then crafts an HTTP request to the file upload endpoint containing a SQL injection payload (e.g., a UNION-based or error-based injection string). The backend SQL query incorporates the unsanitized input, and the attacker iterates over the database schema to extract credentials, configuration data, or sensitive records without ever authenticating to the application.
Remediation No exact patched version number is confirmed in the available input data; the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11133-e0167-1.html and https://www.twcert.org.tw/en/cp-139-11137-c6e5f-2.html should be consulted for vendor-released patch details. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, scan infrastructure to identify all Efence instances at version 1.2.66 or earlier and immediately disable or restrict network access to the file upload endpoint. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Efence

View all
CVE-2023-32754 CRITICAL
9.8 Jun 16

Thinking Software Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8),

CVE-2023-22900 CRITICAL
9.8 Jan 31

Efence login function has insufficient validation for user input. Rated critical severity (CVSS 9.8), this vulnerability
CVE-2026-80235 CRITICAL
9.3 Aug 26

Unauthenticated arbitrary file upload in Thinking Software Technology's EFence (versions up to and including 1.2.66, DB

CVE-2026-80237 HIGH
8.7 Aug 26

Arbitrary file upload in EFence (Thinking Software Technology) versions 1.2.66 and earlier allows authenticated remote a
CVE-2014-4526 MEDIUM POC
4.3 Jul 02

Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2026-80236 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy