Unauthenticated SQL Injection In Channel Software WebAlliance eCommerce
Overview While performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered CVE-2026-108065 , an SQL Injection vulnerability (CWE-89) in Channel Software WebAlliance eCommerce.The exploit allows a malicious actor to read sensitive data from the database, or, if the database user has high privileges, run system commands on the database server. The vulnerability, scored as CVSSv3.1 9.8 (Critical). Product Description WebAlliance eCommerce by Channel Software is an all-in-one B2B e-commerce, digital catalog, and customer portal platform purpose-built for wholesale distributors and industrial manufacturers. Impact The SQL Injection exploit can be leverag
- Vendor
- Rapid7
- Product
- InsightVM / Nexpose / Metasploit
- CVSS v3.1
- 9.8
- EPSS
- 0.009 (p58)
- Exposure class
- Network management
Why it ranks 33 (Notable)
- CVSS v3.1 9.8 critical
- Product class: network management
- Covered by 2 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-108065 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.