Read the docs

isotope

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

isotope records in CISA KEV

No isotope vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-63815 CVE-2026-96599 · GHSA-fvwm-j9pj-rw38

Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Priority HIGH 69

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00462 Published 2026-09-23 No fix listed CWE-330
TI-2026-63816 CVE-2026-96600 · GHSA-7pjx-8r2g-hwpp

Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Priority LOW 31

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00418 Published 2026-09-23 No fix listed CWE-89
Open these records in search →