PT-2026-47729 · Nemon · Nemon Trade Energy+1

Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-10731

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where the '/user-login' endpoint allows unauthenticated attackers to execute arbitrary SQL queries on the backend database. This occurs because the two steps auth code parameter, processed by the twoStepsAuthVerification() function, is susceptible to SQL injection. A successful exploit could result in database enumeration, the unauthorized creation of privileged users, the modification or deletion of critical information, and denial-of-service conditions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-10731

Affected Products

Nemon Trade Energy

Nemon Trade Energy Crm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-10731 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/sql-injection-nemon-products · Patch
• https://twitter.com/CVEnew/status/2064342523154182246 · Twitter Post
• https://t.me/CVEtracker/56285 · Telegram Post