DataLife Engine CVE-2026-96604

Requires a reachable DataLife Engine installation with the Search Module active (default CMS functionality) and the vulnerable engine/modules/search.php endpoint exposed; exploitation is remote and unauthenticated (PR:N, UI:N) against DataLife Engine 18.0. The main limiting factors are that the product must be version 18.0 (or the affected range) and internet-accessible, and that VulDB rates impact as partial (VC:L/VI:L/VA:L) with exploit maturity only proof-of-concept (E:P) - the injection may be blind/limited rather than a full unauthenticated database dump. No fixed version is confirmed since the vendor did not respond.

This is an unauthenticated, network-reachable SQL injection (CWE-89) in DataLife Engine 18.0's Search Module, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it is trivially reachable with no privileges or user interaction. A public exploit exists (VulDB-linked Pastebin), which materially raises real-world risk versus a theoretical finding. However, VulDB rated overall severity only 5.5 by scoring impact as partial across the board (VC:L/VI:L/VA:L, and E:P for proof-of-concept exploit maturity), suggesting a limited or blind injection rather than a demonstrated full-database dump. This is a signal worth reconciling: classic unauthenticated SQLi in a CMS search parameter frequently escalates to full read of credentials/session data (C:H), so the vendor's LOW impact rating may understate realistic worst-case exfiltration - verify against the actual PoC behavior. No EPSS score, no CISA KEV listing, and no CVSS 3.1 vector were provided, so there is no evidence of active exploitation; the practical priority is 'medium and public-exploit-driven' rather than 'critical/emergency,' but the unauthenticated + public-PoC combination makes it a credible target for opportunistic mass scanning against exposed DLE installs. Notably the vendor was contacted and did not respond, so an official patch may not be available.

A remote, unauthenticated attacker sends a crafted HTTP request to engine/modules/search.php manipulating the 'story' argument, which is passed unsafely through strip_data into a SQL query. Because a public exploit is available (Pastebin, referenced by VulDB) and no authentication or user interaction is required, an attacker can automate injection against any internet-exposed DataLife Engine 18.0 site to extract or manipulate database contents.