CVE-2026-66680

CRITICAL9.3

Published 2026-08-20 · Updated 2026-08-20 · Source audit@patchstack.com

Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

CWE-89

Same severity, most recent

CVE-2026-16926
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.
2026-08-20 · score 9.1
CVE-2026-15706
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.
2026-08-20 · score 9.8
CVE-2026-28164
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
2026-08-20 · score 9.6
CVE-2026-74018
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
2026-08-20 · score 9.9
CVE-2026-74016
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
2026-08-20 · score 9.9