PT-2026-35441 · Projeqtor · Projeqtor

Noé Susset

+1

·

Published

2026-04-27

·

Updated

2026-04-28

·

CVE-2026-41462

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ProjeQtor versions 7.0 through 12.4.3
Description An unauthenticated SQL injection exists in the login functionality. The login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.
Recommendations Update to version 12.4.4 or later. As a temporary workaround, restrict access to the authentication endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41462

Affected Products

Projeqtor