SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-41462

CRITICAL · CVSS 9.8 EPSS 0.56%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-04-27 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It involves a SQL injection risk.

CVE
CVE-2026-41462
Severity
CRITICAL
CVSS
9.8
EPSS
0.56%

Original NVD Description

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.