A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. (CVE-2026-96604)
A SQL injection vulnerability exists in SoftNews Media Group DataLife Engine 18.0 within the Search Module's strip_data function. This vulnerability allows remote attackers to manipulate the 'story' argument to execute unauthorized SQL commands. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available. Exploit code is publicly available, but no known exploitation in the wild has been reported.
AI Analysis
Technical Summary
CVE-2026-96604 describes a SQL injection vulnerability in the strip_data function of the engine/modules/search.php file in SoftNews Media Group DataLife Engine 18.0's Search Module. The vulnerability arises from improper sanitization of the 'story' argument, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 3.1 base score of 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating it is remotely exploitable without privileges or user interaction and can impact confidentiality, integrity, and availability to a limited extent. The vendor was contacted but did not respond, and no official patch or fix has been published. Public exploit code exists, but no active exploitation is confirmed.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized SQL command execution on the affected system, potentially resulting in limited confidentiality, integrity, and availability impacts. This could allow attackers to read or modify data within the database remotely without authentication.
Mitigation Recommendations
No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. In the meantime, consider restricting access to the vulnerable module or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'story' parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. (CVE-2026-96604)
Description
A SQL injection vulnerability exists in SoftNews Media Group DataLife Engine 18.0 within the Search Module's strip_data function. This vulnerability allows remote attackers to manipulate the 'story' argument to execute unauthorized SQL commands. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. The vendor has not responded to disclosure attempts, and no patch or mitigation guidance is currently available. Exploit code is publicly available, but no known exploitation in the wild has been reported.
CVSS v3.1
Score 7.3high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-96604 describes a SQL injection vulnerability in the strip_data function of the engine/modules/search.php file in SoftNews Media Group DataLife Engine 18.0's Search Module. The vulnerability arises from improper sanitization of the 'story' argument, allowing remote attackers to inject SQL commands. The vulnerability has a CVSS 3.1 base score of 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating it is remotely exploitable without privileges or user interaction and can impact confidentiality, integrity, and availability to a limited extent. The vendor was contacted but did not respond, and no official patch or fix has been published. Public exploit code exists, but no active exploitation is confirmed.
Potential Impact
Successful exploitation of this vulnerability can lead to unauthorized SQL command execution on the affected system, potentially resulting in limited confidentiality, integrity, and availability impacts. This could allow attackers to read or modify data within the database remotely without authentication.
Mitigation Recommendations
No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor vendor channels for updates. In the meantime, consider restricting access to the vulnerable module or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'story' parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-674c-29gj-gv39
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-96604"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4be21f7a7c54106eee6e7
Added to database: 09/24/2026, 06:07:29 UTC
Last enriched: 09/24/2026, 06:18:39 UTC
Last updated: 09/25/2026, 04:47:33 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.