PT-2026-27439 · Unknown · E-Sic Livre

Bryan Romero + 1 · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-30655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions esiclivre versions prior to 0.2.3

Description A SQL injection flaw exists in the resetaSenha() function within the Solicitante class of esiclivre. This allows unauthenticated remote attackers to gain unauthorized access to sensitive information. The issue is triggered through the cpfcnpj parameter in the '/reset/index.php' endpoint.

Recommendations Update esiclivre to version 0.2.3 or later. As a temporary workaround, restrict access to the '/reset/index.php' endpoint. Avoid using the cpfcnpj parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-30655

Affected Products

E-Sic Livre

References · 3

• 🔥 https://github.com/brynax/CVE-2026-30655 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30655 · Security Note
• https://github.com/esiclivre/esiclivre · Note