SZB-a6dab97134
EUVD lists SQL injection flaw in MLS On The Fly up to 1.8.1.5
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Favethemes
- Product
- MLS On The Fly
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a SQL injection vulnerability in MLS On The Fly versions up to 1.8.1.5 from Favethemes, scored 8.5/10 (CVSS v3.1). The entry was published 2026-10-29 and updated 2026-10-30, and the item reports no known exploitation.
If you use Favethemes
Update MLS On The Fly to a version later than 1.8.1.5 when available
Check the EUVD entry EUVD-2026-112962 for patch status
Review database logs for unusual queries until patched
What the sources say 1
· Mastodon: “Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.” Source