CVE Intelligence
Analysis AI-assisted

CVE-2026-56034: Library Management System up to 3.5.7 - Unauthenticated SQL Injection

CVE-2026-56034 describes an unauthenticated SQL injection in Library Management System versions up to and including 3.5.7, classified as CWE-89. The CNA, Patchstack, assigned a CVSS 3.1 base score of 9.3 (Critical), but the record provides no fixed version and no structured affected-version data. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Patchstack has published CVE-2026-56034, which describes an unauthenticated SQL injection in the Library Management System in versions up to and including 3.5.7. The weakness is classified as CWE-89 (SQL Injection).

Impact

  • The CNA-assigned CVSS 3.1 base score is 9.3 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.
  • According to the vector, exploitation is network-based, requires no privileges and no user interaction, and has high confidentiality impact and low availability impact.
  • SQL injection can allow database content to be read or altered, depending on how the application and its database account are configured. The record does not detail which data would be affected.

Affected products and versions

  • Product: Library Management System, versions up to and including 3.5.7, as stated in the description.
  • The record contains no structured affected or fixed version data, so the exact lower boundary and any fixed release are unknown.
  • The Patchstack reference path refers to a WordPress plugin, which suggests the product is distributed as a WordPress plugin. This is an inference, not a confirmed fact.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS reports a probability of 0.004 with a percentile of 0.32415, dated 2026-10-13 in the record.

Remediation and mitigation

  • Identify any installation of the Library Management System and its version. Treat versions up to 3.5.7 as vulnerable until the vendor or plugin maintainer confirms a fixed release.
  • Monitor the Patchstack reference and vendor channels for an updated release and apply it as soon as it is available.
  • Until a fix is applied, consider restricting access to administrative and public input points where feasible, and review the privileges of the database account used by the application to limit the impact of injection.
  • Keep verified backups before making changes.

Detection guidance

  • Review web server and application logs for unusual or malformed parameter values directed at the library application, and for database errors returned in web responses.
  • Monitor for unexpected database activity or data exports originating from the web application's database account.
  • A web application firewall rule that flags SQL metacharacters in inputs may serve as a temporary compensating control, but it is not a substitute for patching.

Limitations of the available information

  • The record contains no fixed version, no vendor advisory details beyond the Patchstack reference, and no exploit availability data.
  • The title is missing from the source record; the titles used here are derived from the description.
  • The source status is Deferred, so details may change as sources are updated.
  • Whether a given environment is exposed is unknown.

Frequently asked questions

What is CVE-2026-56034?

It is a record describing an unauthenticated SQL injection in Library Management System versions up to and including 3.5.7, classified as CWE-89.

How severe is it according to the record?

The CNA Patchstack assigned a CVSS 3.1 base score of 9.3, rated Critical, with network attack vector and no privileges or user interaction required.

Is it being actively exploited?

The CVE is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. Users should check with the vendor or plugin maintainer and watch the Patchstack reference for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.