Is CVE-2026-96602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96602 being exploited in the wild.

How severe is CVE-2026-96602?

High severity, with a CVSS score of 7.3, published 23 September 2026.

Which products and versions are affected?

Abdurrab5 Online Makeup Store 1.0.

Is there a fix for CVE-2026-96602?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96602 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96602?

Check whether you run Abdurrab5 Online Makeup Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96602: Abdurrab5 online-makeup-store SQL injection in customer login

CVE-2026-96602 · Severity: high · CVSS 7.3 · Published 2026-09-23

A web-based makeup store application contains a critical flaw in its customer login page that allows attackers to bypass authentication without valid credentials. An attacker can inject malicious SQL commands through the login form to gain unauthorized access to customer accounts, view order history and personal data, and extract the entire database including all user credentials stored in plaintext.

Technologies: Abdurrab5 Online Makeup Store. Vendors: Abdurrab5.

Quick answers

Is CVE-2026-96602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96602 being exploited in the wild.
How severe is CVE-2026-96602?: High severity, with a CVSS score of 7.3, published 23 September 2026.
Which products and versions are affected?: Abdurrab5 Online Makeup Store 1.0.
Is there a fix for CVE-2026-96602?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96602 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96602?: Check whether you run Abdurrab5 Online Makeup Store at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The customerSignin.php authentication handler concatenates username and password POST parameters directly into SQL queries without prepared statements, escaping, or input validation (CWE-89). An unauthenticated attacker can submit username=' OR '1'='1' -- to bypass the password check and log in as the first customer, or use UNION/error-based techniques for database extraction. No authentication is required and the exploit is trivial to execute remotely.

Affected products

Abdurrab5 online-makeup-store 1.0

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.