CVE-2026-108541: highwarden Super Store Finder index.php sql injection
A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
highwarden Super Store Finderto a version that resolves this vulnerability.Fixed in 3.9
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it over the network, but the listed CVSS vector indicates low privileges are required. No user interaction is needed.
Which deployments are affected?
highwarden Super Store Finder versions up to 3.8 are affected. The vulnerable functionality is associated with /products/superstorefinder/index.php and its lat and lng arguments.
Is public exploit code available?
Yes. The exploit has been publicly disclosed and may be used, which increases the urgency of remediation.
What is the recommended remediation?
Upgrade highwarden Super Store Finder to version 3.9. The available information identifies this version as addressing the issue.