CVE-2026-86170 MEDIUM

CVE-2026-86170: DefaultFuction CRM edit.php sql injection

Vendor Defaultfuction

Product CRM

Weakness CWE-89 · SQLi

Published September 6, 2026

Last update September 6, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Key dates

02Disclosure timeline

September 6, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-86170 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html AskarLabs — CWE-89 write-up SQL Injection

Related vulnerabilities

04Related CVE

CVE-2026-16810 Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter CVE-2026-66622 WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability CVE-2026-15023 Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys CVE-2026-66478 WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability