Medium severity · published Aug 4, 2026
CVE-2026-69704
Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized database operations including data deletion and extraction.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Atals-Livre · maximeAmini
through de0893f · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69704
gist.github.com
https://gist.github.com/arjunjaincs/8cd878b6628d587a1139febd40de9ac6
github.com
https://github.com/maximeAmini/Atals-Livre
www.vulncheck.com
https://www.vulncheck.com/advisories/atals-livre-sql-injection-via-unsanitized-get-parameter-in-supp
More from Atals-Livre
9.8
CVE-2026-69703
Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit