Which versions of ProjeQtor are affected by CVE-2026-41462?

ProjeQtor versions 7.0-12.4.3 contain a critical SQL injection vulnerability in the login page that allows unauthenticated attackers to compromise your project management system and underlying…

Is there a public PoC exploit available for CVE-2026-41462?

Yes, a public proof-of-concept exploit is available for CVE-2026-41462. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-41462?

Within 24 hours, identify all ProjeQtor 7.0-12.4.3 deployments and restrict network access to these systems to essential personnel only. Within 7 days, deploy WAF rules to block SQL injection in the login endpoint, rotate all database and system credentials associated with ProjeQtor, review database user privileges to minimize scope, and enable comprehensive audit logging. Within 30 days, execute a remediation plan to either wait for a vendor patch and upgrade immediately upon release, or migrate to an alternative project management platform; conduct forensic analysis of authentication logs and database access records for signs of exploitation.

ProjeQtor CVE-2026-41462

Q: What is the CVSS score of CVE-2026-41462?

CVE-2026-41462 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25865 CRITICAL

SQL Injection (CWE-89)

2026-04-27 VulnCheck

Information Disclosure SQLi Projeqtor

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Pre-auth, remote, no-interaction SQL injection with low complexity gives AV:N/AC:L/PR:N/UI:N; full database confidentiality, integrity, and availability impact yields C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:56 vuln.today

PoC Detected

Apr 27, 2026 - 18:36 vuln.today

Public exploit code

CVSS changed

Apr 27, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

EUVD ID Assigned

Apr 27, 2026 - 15:30 euvd

EUVD-2026-25865

CVE Published

Apr 27, 2026 - 15:08 nvd

CRITICAL 9.3

DescriptionCVE.org

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.

Articles & Coverage 1

POC CVE-2026-41462: Critical Unauthenticated SQL Injection in ProjeQtor ≤ 12.4.3 (CVSS 9.8) Apr 28, 2026

AnalysisAI

SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the username field, because the login variable is concatenated directly into a query without parameterization. Affecting versions 7.0 through 12.4.3, it can be leveraged to create privileged accounts, exfiltrate database contents, and - where the DB account has elevated OS privileges - achieve operating-system command execution. Publicly available exploit code exists (VulnCheck advisory and multiple PoCs), though EPSS remains low at 0.09% and it is not listed in CISA KEV.

Technical ContextAI

ProjeQtor is a PHP-based open-source project management / QMS web application backed by a relational database (typically MySQL/MariaDB). The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: the authentication handler builds its lookup query by string-concatenating the attacker-supplied login/username value rather than using prepared statements or bound parameters. Because this occurs at the pre-authentication login endpoint, the injected SQL executes with whatever rights the application's database user holds. The single CPE cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:* confirms the affected component is the ProjeQtor application itself across the vulnerable version band, not a bundled third-party library.

RemediationAI

Upgrade ProjeQtor to a release later than 12.4.3 that contains the login-parameterization fix; the input does not specify an exact fixed version, so treat this as Patch available per vendor advisory and confirm the fixed build directly with ProjeQtor (https://www.projeqtor.com) and the VulnCheck advisory (https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login) before deploying. Until patched, restrict network reachability of the login/authentication endpoint by placing the application behind a VPN or IP allowlist, and deploy a WAF rule to block SQL metacharacters and injection patterns in the username field (trade-off: WAF signatures can be bypassed and may cause false positives on legitimate logins). Additionally, enforce least privilege on the ProjeQtor database account - remove FILE, SUPER, and OS-command-capable privileges so a successful injection cannot escalate to operating-system command execution (trade-off: none significant, but requires validating the app still functions with reduced grants). Do not rely on these controls as a permanent substitute for the vendor patch.