Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. (CVE-2026-78260)

CVE-2026-78260 is an unauthenticated SQL Injection vulnerability affecting Epayco software versions up to 8.4.6. The flaw allows remote attackers to inject SQL commands without requiring any authentication, which can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited denial of service (low availability impact). The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity. No official patch or remediation information is provided in the available data, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in unauthorized access to sensitive database information due to SQL injection, compromising confidentiality. The integrity impact is not indicated, and availability impact is low. The vulnerability can be exploited remotely without any authentication, increasing the risk exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply any available workarounds or mitigations provided by the vendor. Monitor vendor channels for updates regarding patches or official fixes.