CVE-2026-85652
Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute
CVSS score
6.5
EPSS probability
%0.6
Risk score
0.0
Published
25 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
8.8
CVE-2026-94121
WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability
1
Patch status unknownEPSS %0
5.3
CVE-2026-15993
Form Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
1
Patch status unknownEPSS %0
8.8
CVE-2026-105885
WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability
1
Patch status unknownEPSS %0
8.8
CVE-2026-102377
WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
1
Patch status unknownEPSS %0
6.1
CVE-2026-85645
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting
1
Patch status unknownEPSS %0
7.2
CVE-2026-96813
Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
1
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-85652"