CVE-2026-108541 Details
Description
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A SQL injection vulnerability has been identified in Highwarden Super Store Finder versions prior to 3.8. The issue arises in an unknown function within the file /products/superstorefinder/index.php, where the manipulation of the lat/lng argument allows for SQL injection. This vulnerability can be exploited remotely.
Users are advised to upgrade to Highwarden Super Store Finder version 3.9 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/948351 | CISA-ADP | Issue TrackingPermission Required |
| https://codecanyon.net/item/super-store-finder/3630922 | [email protected] | ProductPermission RequiredVendor |
| https://vuldb.com/cve/CVE-2026-108541 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/948351 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416196 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416196/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| highwarden Super Store Finder | <= 3.8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |