CVE-2026-41462

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41462", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-20T16:07:47.310Z", "datePublished": "2026-04-27T15:08:35.678Z", "dateUpdated": "2026-07-14T20:00:50.075Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T20:00:50.075Z"}, "title": "ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "ProjeQtor", "product": "ProjeQtor", "repo": "https://sourceforge.net/projects/projectorria", "versions": [{"status": "affected", "version": "7.0", "lessThanOrEqual": "12.4.3", "versionType": "custom"}, {"status": "unaffected", "version": "12.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndIncluding": "12.4.3"}]}]}], "descriptions": [{"lang": "en", "value": "ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.<br>"}]}], "references": [{"url": "https://damiri.fr/en/cves/CVE-2026-41462", "tags": ["technical-description", "exploit"]}, {"url": "https://gryfman.fr/cves/CVE-2026-41462", "tags": ["technical-description", "exploit"]}, {"url": "https://www.projeqtor.com", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Yassine Damiri", "type": "finder"}, {"lang": "en", "value": "No\u00e9 Susset", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T17:43:39.957495Z", "id": "CVE-2026-41462", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:43:49.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41462", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-27T17:43:39.957495Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T17:43:43.654Z"}}], "cna": {"title": "ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yassine Damiri"}, {"lang": "en", "type": "finder", "value": "No\u00e9 Susset"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://sourceforge.net/projects/projectorria", "vendor": "ProjeQtor", "product": "ProjeQtor", "versions": [{"status": "affected", "version": "7.0", "versionType": "custom", "lessThanOrEqual": "12.4.3"}, {"status": "unaffected", "version": "12.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://damiri.fr/en/cves/CVE-2026-41462", "tags": ["technical-description", "exploit"]}, {"url": "https://gryfman.fr/cves/CVE-2026-41462", "tags": ["technical-description", "exploit"]}, {"url": "https://www.projeqtor.com", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.", "supportingMedia": [{"type": "text/html", "value": "ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "12.4.3", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-14T20:00:50.075Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41462", "state": "PUBLISHED", "dateUpdated": "2026-07-14T20:00:50.075Z", "dateReserved": "2026-04-20T16:07:47.310Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-27T15:08:35.678Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ProjeQtor", "repo": "https://sourceforge.net/projects/projectorria", "vendor": "ProjeQtor", "versions": [{"lessThanOrEqual": "12.4.3", "status": "affected", "version": "7.0", "versionType": "custom"}, {"status": "unaffected", "version": "12.4.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions."}], "id": "CVE-2026-41462", "lastModified": "2026-06-17T10:46:44.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41462", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T17:43:39.957495Z", "version": "2.0.3"}}]}, "published": "2026-04-27T16:16:45.340", "references": [{"source": "disclosure@vulncheck.com", "url": "https://damiri.fr/en/cves/CVE-2026-41462"}, {"source": "disclosure@vulncheck.com", "url": "https://gryfman.fr/cves/CVE-2026-41462"}, {"source": "disclosure@vulncheck.com", "url": "https://www.projeqtor.com"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0,12.4.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "12.4.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ProjeQtor", "source": "cna", "vendor": "ProjeQtor"}, "product": "projeqtor", "vendor": "projeqtor"}], "analysis": {"en": {"generated_at": "2026-04-28T04:21:45.812155+00:00", "value": {"mitigation_remediation": ["Upgrade to ProjeQtor 12.4.4 or later, which removes the insecure concatenation from the authentication code.", "If an upgrade is not immediately feasible, restrict access to the login endpoint by firewall rules or IP whitelisting until a patch can be applied.", "Reconfigure the database account used by ProjeQtor to have only the minimal privileges required for normal operation; remove any rights that permit reading system tables or executing operating system commands.", "As an interim protective step, deploy a web application firewall or input\u2011validation layer that blocks classic SQL injection attempts to the login field."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of ProjeQtor from version 7.0 up to and including 12.4.3 are affected. The affected component is the authentication module that processes login requests submitted via web interfaces; the application runs under the database user account specified in the configuration. The scope extends to any system where ProjeQtor is deployed with a database user that has privileges sufficient to execute system commands.", "description_and_impact": "ProjeQtor versions between 7.0 and 12.4.3 expose a login endpoint where the username field is concatenated directly into a SQL query without any form of parameterization or sanitization. Attackers can supply a crafted username that passes through the authentication logic and inject arbitrary SQL expressions, enabling the creation of privileged user accounts, extraction of sensitive data, and, if the database account has elevated privileges, the execution of operating system commands. This flaw allows an unauthenticated user to compromise confidentiality, integrity, and availability of the system. The vulnerability is a classic SQL injection (CWE\u201189).", "risk_and_exploitability": "The CVSS score of 9.3 classifies the issue as critical. EPSS data is not available, so a precise exploitation probability cannot be estimated, but the absence of KEV listing does not diminish the risk posed by the vulnerability. The attack can be carried out remotely by sending an unauthenticated HTTP request to the login service; the lack of input validation means an attacker does not need prior access. Exploitation would require the database user to have sufficient privileges to a degree that allows schema manipulation and, if present, OS command execution, which is often the case in default ProjeQtor deployments."}}}}, "created": "2026-04-28T04:30:20.927895+00:00", "updated": "2026-04-28T04:30:21.144963+00:00", "vendors": ["projeqtor", "projeqtor$PRODUCT$projeqtor"]}