PT-2026-3042 · Kmaleon · Kmaleon

Amel Bouziane-Leblond · Published 2026-01-15 · Updated 2026-01-15 · CVE-2021-47766

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kmaleon version 1.1.0.205

Description Kmaleon version 1.1.0.205 contains an authenticated SQL injection flaw in the tipocomb parameter of the 'kmaleonW.php' file. This allows attackers to manipulate database queries. Exploitation is possible using boolean-based, error-based, and time-based blind SQL injection techniques, potentially leading to the extraction or manipulation of database information. The vulnerable parameter is tipocomb within the 'kmaleonW.php' file.

Recommendations Apply updates to address the SQL injection flaw in the 'kmaleonW.php' file and the tipocomb parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47766

Affected Products

Kmaleon

References · 4

• 🔥 https://exploit-db.com/exploits/50499 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47766 · Security Note
• https://web.archive.org/web/20210616143348/https://levelprograms.com/kmaleon-abogados · Note
• https://twitter.com/CVEnew/status/2011926102579822903 · Twitter Post