CVE-2026-96604

Name of the Vulnerable Software and Affected Versions SoftNews Media Group DataLife Engine version 18.0

Description An issue exists in the Search Module within the strip data() function of the engine/modules/search.php file. A remote attacker can trigger a SQL injection by manipulating the story argument. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the engine/modules/search.php file or avoid using the story argument in the search functionality.