by Kastro
Paper/Archive/CVE-2026-1432

CVE-2026-1432

T-Systems Buroweb — SQL injection (SQLi) on the Buroweb platform

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
34
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 28.4.284 × 205.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.

Affected

ProductAffectedFixed inSource
Buroweb< 2505.0.132505.0.13CNA

Scores by source

INCIBE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchincibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-buroweb-platform