PT-2026-27439 · Unknown · E-Sic Livre

Bryan Romero + 1 · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-30655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions esiclivre versions prior to 0.2.3

Description A SQL injection flaw exists in the resetaSenha() function within the Solicitante class of esiclivre. This allows unauthenticated remote attackers to gain unauthorized access to sensitive information. The issue is triggered through the cpfcnpj parameter in the '/reset/index.php' endpoint.

Recommendations Update esiclivre to version 0.2.3 or later. As a temporary workaround, restrict access to the '/reset/index.php' endpoint. Avoid using the cpfcnpj parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-30655

Produtos afetados

E-Sic Livre

Referências · 3

• 🔥 https://github.com/brynax/CVE-2026-30655 · Exploit
• https://github.com/esiclivre/esiclivre · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30655 · Nota de Segurança