Skip to content
Threat Feed
Subscribe

Product

Vendure

1 brief RSS
critical advisory

Vendure Shop API Unauthenticated SQL Injection Vulnerability (CVE-2026-40887)

An unauthenticated SQL injection vulnerability (CVE-2026-40887) exists in the Vendure Shop API affecting PostgreSQL, MySQL/MariaDB, and SQLite databases, where a user-controlled query string parameter is directly interpolated into a raw SQL expression, potentially leading to arbitrary code execution.

Vendure sqli cve-2026-40887 web-application injection
2r 1t 1c