CVE-2026-11480: SQL Injection in Chengdu Everbrite Network Technology BeikeShop
CVE-2026-11480 is a SQL injection vulnerability in Chengdu Everbrite Network Technology's BeikeShop product up to version 1.6.0.22. The issue exists in the Admin Design Builder Endpoint, specifically in the beike/Admin/Routes/admin.php file, where manipulation of the argument settings.value can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. A patch has been identified but no official remediation level or patch availability is confirmed in the advisory.
AI Analysis
Technical Summary
This vulnerability allows remote attackers to perform SQL injection by manipulating the settings.value parameter in the Admin Design Builder Endpoint of BeikeShop versions up to 1.6.0.22. The affected file is beike/Admin/Routes/admin.php. The vulnerability is confirmed public with an exploit available. A patch commit identifier (2fa9805411088069fcc3b0c15b2f1f33d6e09958) is referenced, indicating a fix exists, but no official vendor advisory or remediation level is provided in the data.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no user interaction, and partial confidentiality, integrity, and availability impact.
Mitigation Recommendations
A patch is available as indicated by the referenced patch commit. It is recommended to apply the patch identified by commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 to remediate this vulnerability. Since no official vendor advisory or remediation level is provided, users should verify patch availability and deployment instructions from the vendor or trusted sources before applying.
CVE-2026-11480: SQL Injection in Chengdu Everbrite Network Technology BeikeShop
Description
CVE-2026-11480 is a SQL injection vulnerability in Chengdu Everbrite Network Technology's BeikeShop product up to version 1.6.0.22. The issue exists in the Admin Design Builder Endpoint, specifically in the beike/Admin/Routes/admin.php file, where manipulation of the argument settings.value can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. A patch has been identified but no official remediation level or patch availability is confirmed in the advisory.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/beikeshop/beikeshopRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability allows remote attackers to perform SQL injection by manipulating the settings.value parameter in the Admin Design Builder Endpoint of BeikeShop versions up to 1.6.0.22. The affected file is beike/Admin/Routes/admin.php. The vulnerability is confirmed public with an exploit available. A patch commit identifier (2fa9805411088069fcc3b0c15b2f1f33d6e09958) is referenced, indicating a fix exists, but no official vendor advisory or remediation level is provided in the data.
Potential Impact
Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no user interaction, and partial confidentiality, integrity, and availability impact.
Mitigation Recommendations
A patch is available as indicated by the referenced patch commit. It is recommended to apply the patch identified by commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 to remediate this vulnerability. Since no official vendor advisory or remediation level is provided, users should verify patch availability and deployment instructions from the vendor or trusted sources before applying.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-07T09:53:15.168Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a26348de29bf47b50864c98
Added to database: 06/08/2026, 03:18:37 UTC
Last enriched: 06/15/2026, 08:35:17 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.