CVE-2026-108065

WebAlliance eCommerce
20/100
predicted likelihood
CVSS9.8
EPSS0.8%
KEVNone
CWE-89
SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — missing] allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID parameter value containing a single quote and stacked SQL query.
EPSS 0.008 (probability of exploitation) · CVSS base 9.8 · 1 public PoC/exploit reference(s) available
Public PoC / Exploit1

Defensive review only — these references demonstrate exploitability.

trickestReference (www.rapid7.com)
References1
NVD detailReferencerapid7.com
Mentions 1