← Vulnerability feed

Vulnerability record · CVE-2026-29174 · published 10 March 2026

CVE-2026-29174: Craftcms craft commerce sql injection vulnerability

Craftcms · Craft Commerce

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.

8.7 CVSS 4.0 High EPSS 0.52% · top 58.0% CWE-89 · SQL injection
8.7CVSS 4.0 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort[0][direction] and sort[0][sortField] parameters are concatenated directly into an addOrderBy() clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. This vulnerability is fixed in 5.5.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/craftcms/commerce/commit/094d69df24b925544f337c38e2ec1effcd5395c7 Patch
https://github.com/craftcms/commerce/commit/a2ea853935ef03297ea1298bdb0d8c55ec5daf7b Patch
https://github.com/craftcms/commerce/security/advisories/GHSA-pmgj-gmm4-jh6j ExploitVendor Advisory

Track CVE-2026-29174 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-29172Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables t…EPSS 0.52%8.6CVE-2026-29175Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product T…EPSS 0.25%6.3CVE-2026-31867Craftcms craft commerce insecure direct object reference vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in …EPSS 0.32%6.2CVE-2026-25485Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%6.2CVE-2026-25482Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability e…EPSS 0.41%6.2CVE-2026-25483Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exist…EPSS 0.39%6.1CVE-2026-25522Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%6.1CVE-2026-25486Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to …EPSS 0.34%

Source: NIST National Vulnerability Database (record CVE-2026-29174), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.