PatchSiren

likeadmin-likeshop CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH likeadmin-likeshop CVE published 2026-07-24

CVE-2026-65707

CVE-2026-65707 is an authenticated SQL injection vulnerability in Likeshop through 3.0.5. The vulnerability allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type cast [truncated]