Is CVE-2026-15490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15490 being exploited in the wild.

How severe is CVE-2026-15490?

High severity, with a CVSS score of 7.3, published 12 July 2026.

Which products and versions are affected?

RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99.

Is there a fix for CVE-2026-15490?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15490 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-15490?

Check whether you run RafyMrX TOKO-ONLINE-ROTI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15490: RafyMrX TOKO-ONLINE-ROTI SQL injection in proses/add.php

CVE-2026-15490 · Severity: high · CVSS 7.3 · Published 2026-07-12

A security vulnerability exists in TOKO-ONLINE-ROTI, an online bakery shop application. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of customer information or disruption of the store's operations. Because a public exploit is available and the vendor has not responded to reports, the risk to active installations is high.

Technologies: RafyMrX TOKO-ONLINE-ROTI. Vendors: RafyMrX.

Quick answers

Is CVE-2026-15490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15490 being exploited in the wild.
How severe is CVE-2026-15490?: High severity, with a CVSS score of 7.3, published 12 July 2026.
Which products and versions are affected?: RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99.
Is there a fix for CVE-2026-15490?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15490 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-15490?: Check whether you run RafyMrX TOKO-ONLINE-ROTI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the RafyMrX TOKO-ONLINE-ROTI web application through the 'proses/add.php' endpoint. The vulnerability is caused by improper neutralization of special elements in the 'kode_produk' and 'kd_cs' parameters. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to manipulate database queries. This can lead to unauthorized data retrieval, modification, or deletion. A public exploit has been released, and the vendor has not provided a patch as of the disclosure date.

Affected products

RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99

Timeline

2026-07-12: disclosed: Vulnerability disclosed via VulDB and NVD
2026-07-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.