CVE-2026-1432

Critical

Published: 03/02/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. Several parameters in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON' do not properly sanitize user input. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.

Risk Assessment

An attacker could gain unauthorized access to confidential data in the database, potentially leading to a breach of confidentiality and integrity.

Recommendation

It is recommended to immediately update the Buroweb platform to the latest version that includes security fixes. Also, conduct a code audit for proper input sanitization.

Original NVD description (English source)

SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.