What’s Vulnerable › Vulnerabilities

CVE-2026-15600: SQL Injection in Alior Bank raty PrestaShop module

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-18
• Weakness: CWE-89

Description

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

Affected products

• Alior Bank raty: from 8.1.9 before 8.1.12; from 9.0.5 before 9.0.8 — fixed in 8.1.12, 9.0.8

How to fix

Upgrade to a fixed version: Alior Bank raty 8.1.12, 9.0.8. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2026/09/CVE-2026-7848
• https://www.aliorbank.pl/klienci-indywidualni/kredyty-i-pozyczki/kredyty-ratalne/informacje-dla-partnerow-handlowych.html

Get alerted when CVE-2026-15600 or the next vulnerability affects your stack