CVE-2026-62031

Critical

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

Patchstack·CWE-89·Published 2026-10-10

CVSS

9.3

EPSS

0.00

KEV

Exploits

cve.orgen

214 chars

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through 2.2.0.

NVDen

60 chars

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.3	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
3.1	Secondary	NVD	9.3	3.9	4.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L