CVE-2026-41462

CRITICAL

9.8

Description

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie4/27/2026

Derniere modification4/27/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-89

References

https://damiri.fr/en/cves/CVE-2026-41462(disclosure@vulncheck.com)

https://gryfman.fr/cves/CVE-2026-41462(disclosure@vulncheck.com)

https://www.projeqtor.com(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login(disclosure@vulncheck.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.