EUVD-2026-104125
GHSA-c2vh-7336-w495
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach /login/ap_Login.aspx/start endpoint
-
DeliveryCraft UNION-based payload in sInfo POST
-
ExploitInject via unsanitized SQL query
-
ExecutionDump credentials and user data
-
ImpactReuse stolen credentials for privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required: the vulnerable sInfo parameter is exposed on a pre-authentication login endpoint (/login/ap_Login.aspx/start), so exploitation works against default deployments reachable over the network. The only real prerequisite is network reachability of that Integratec login endpoint; the CVSS vector (PR:N/UI:N) confirms no authentication and no user interaction are needed. The practical limiting factor is exposure scope - organizations that restrict the login interface to internal networks or behind a WAF/VPN materially reduce reachability, and the product's niche footprint limits the pool of affected targets. |
| Impact | This is a credible, actionable priority rather than a paper-tiger high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, pre-authentication exploitation against a login endpoint - the easiest class of attack surface to reach. The 8.8 base score is driven primarily by VC:H (full database read, including credentials per the description), with VI:L/VA:L reflecting the data-manipulation and partial-DoS (error/crash) side effects of UNION-based SQLi. Signal comparison is constrained because key exploitation-telemetry is simply absent from the input: there is no EPSS probability, no CISA KEV listing, and no POC indicator provided, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied either. The one genuine tension is prevalence versus severity: the vulnerability class is trivially exploitable and well-understood (UNION-based SQLi on a named parameter and endpoint), but 'Integratec' is an obscure product, so this reads as a serious issue for the specific organizations running it rather than an internet-wide emergency. Absence of EPSS/KEV should NOT be read as low risk - it reflects missing data and the product's low visibility, not a demonstrated lack of exploitability. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted POST request to /login/ap_Login.aspx/start with a malicious UNION-based payload in the sInfo parameter, extracting credentials and user records directly from the backend database. No public exploit is identified in the provided data, but the vulnerability is pre-authentication and the exact parameter and endpoint are documented, so weaponization by a skilled attacker is straightforward (AV:N/AC:L/PR:N/UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.
RemediationAI
No vendor-released patch is identified in the available data; consult the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-integratec-application for vendor guidance and updated fixed-version information. In the meantime, prioritize eliminating the injection at the source by replacing dynamic SQL in the ap_Login.aspx login path with parameterized queries or prepared statements and allowlisting or strictly validating the sInfo parameter; this is the durable fix but requires code changes and regression testing of the login flow. Compensating controls include deploying WAF rules that detect and block UNION SELECT and SQL injection patterns on POST requests to /login/ap_Login.aspx/start (tune to avoid false positives on legitimate login traffic), restricting the login endpoint to trusted networks, VPN, or zero-trust access proxies (side effect: external users lose direct access), and running the application's database account with least privilege so a successful injection cannot read unrelated schemas or perform privilege escalation. Monitor web and database logs for anomalous UNION queries or error spikes, and treat any exposed instance as requiring urgent review because no public exploit was identified at time of analysis but the endpoint is pre-authentication and remotely reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 improper neutralization of special elements in SQL commands, specifically UNION-based SQL injection in the ASP.NET endpoint /login/ap_Login.aspx/start. The sInfo parameter is accepted via POST before authentication, and insufficient query parameterization lets an attacker append a UNION SELECT to the backend query to return data from other tables. The exposed CPE cpe:2.3:a:integratec:integratec:*:*:*:*:*:*:*:* uses a wildcard version, so the advisory does not publish a granular affected-version list; any Integratec deployment exposing this login endpoint should be considered in scope. Data confidentiality impact is high, while integrity and availability impacts are limited (I:L/A:L), consistent with possible error-induced partial denial of service and follow-on abuse such as data exfiltration or privilege escalation. The assessed vector confirms network reachability is the key prerequisite: AV:N/PR:N/UI:N, with no special configuration required, subject to network restrictions or WAF/VPN placement reducing exposure.
Know when Integratec gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Unauthenticated network SQLi on a login endpoint gives AV:N/AC:L/PR:N/UI:N; C:H for credential/data theft, with I:L/A:L reflecting data tampering and partial-DoS errors.
Primary rating from Vendor (INCIBE).
CVSS VectorVendor: INCIBE
DescriptionCVE.org
SQL injection (SQLi) vulnerability-specifically a UNION-based vulnerability-in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
Executive ViewAI
Integratec's pre-authentication login endpoint is vulnerable to SQL injection, allowing remote unauthenticated attackers who can reach the interface to read database contents, including credentials and user information. No public exploit was identified at time of analysis, but exposure of credentials and user data creates organizational risk of account compromise, lateral movement, and regulatory scrutiny if the login service is reachable from untrusted networks.
No vendor-released patch identified at time of analysis; restrict /login/ap_Login.aspx/start to trusted networks or VPN, deploy WAF virtual patching for UNION-based SQL injection in the sInfo parameter, disable the endpoint if unnecessary, enforce least-privilege database accounts, monitor and audit database queries, and rotate potentially exposed credentials.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB