VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/VikRentItems Flexible Rental Management System (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/VikRentItems Flexible Rental Management System.
2. 2Review the reported fix. Update Unknown/VikRentItems Flexible Rental Management System to 1.2.4 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 19, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 19, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color SettingSame generic ecosystem
• WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' ParameterSame generic ecosystem
• Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment ContentSame generic ecosystem
• SEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()Same generic ecosystem
• Divi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX ActionSame generic ecosystem
• Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_pluginsSame generic ecosystem