CVE-2026-96601 describes a remote SQL injection vulnerability in the Admin Login Handler of Abdurrab5 online-makeup-store. The vulnerability arises from improper sanitization of the id/password parameters in index.php, allowing attackers to inject SQL commands. The product's rolling release model prevents identification of specific affected versions. Public exploit code exists, but no confirmed in-the-wild exploitation is reported. The CVSS 3.1 base score is 7.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized SQL command execution, potentially compromising database confidentiality, integrity, and availability. This could allow attackers to access or modify sensitive data remotely without authentication. However, no active exploitation in the wild has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product uses a rolling release model, monitor vendor communications for updates or fixes. In the meantime, consider implementing web application firewall rules to detect and block SQL injection attempts targeting the id/password parameters.