Which versions of MegaCMS are affected by EUVD-2026-26199?

MegaCMS v12.0.0 contains an unauthenticated SQL injection vulnerability (CVSS 10.0) in the public registration endpoint that enables attackers to read, modify, or delete the entire database.

How to fix or mitigate EUVD-2026-26199?

Within 24 hours: isolate the affected registration endpoint from public access using network segmentation, WAF rules, or temporary disable pending permanent fix; apply emergency rate limiting and SQL injection detection on all database queries. Within 7 days: implement input validation and parameterized queries on the affected endpoint as interim fix; deploy enhanced monitoring and alerting for SQL injection patterns; conduct database audit for evidence of compromise. Within 30 days: contact vendor for patch or security update timeline; prepare application code review of all public endpoints for similar SQL injection flaws; evaluate migration to a patched MegaCMS version or alternative CMS if patch timeline is unacceptable.

MegaCMS EUVD-2026-26199

Q: What is the CVSS score of EUVD-2026-26199?

EUVD-2026-26199 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-3325 CRITICAL

SQL Injection (CWE-89)

2026-04-29 cve-coordination@incibe.es

SQLi

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, unauthenticated, no interaction pre-auth SQLi (AV:N/AC:L/PR:N/UI:N) giving full database read/write, so C/I/A all High; scope Unchanged as impact stays within the DB-backed app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:32 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 09:22 euvd

EUVD-2026-26199

CVE Published

Apr 29, 2026 - 09:16 nvd

CRITICAL 10.0

DescriptionCVE.org

SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.

AnalysisAI

Unauthenticated SQL injection in MegaCMS v12.0.0 lets remote attackers inject arbitrary SQL through the 'id_territorio' parameter of the '/web_comunications/cms/get_provincias' endpoint, which is invoked immediately after the public registration form is submitted. Because no authentication is required and the endpoint is reachable during normal user registration, an attacker can read, modify, or destroy the backing database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%), but CISA's SSVC framework rates the technical impact as total and the flaw as automatable.

Technical ContextAI

MegaCMS is a web-based content management and CRM/loyalty ('sistemas de fidelización') platform. The affected code path is a POST handler at '/web_comunications/cms/get_provincias' that appears to return province/territory data for a registration form's territory selector. The 'id_territorio' parameter is concatenated into a SQL query without adequate validation or parameterisation, the classic root cause captured by CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the lookup fires as part of the registration workflow, the injectable query executes before any account or session exists, exposing the database layer directly to anonymous input.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, so the primary compensating control is to eliminate untrusted input reaching the query: restrict or disable the '/web_comunications/cms/get_provincias' endpoint until the vendor issues a fix, or place a WAF rule that blocks SQL metacharacters and non-numeric values in the 'id_territorio' POST parameter (side effect: legitimate territory lookups during registration may break, potentially blocking new sign-ups). Where feasible, disable the public registration form that triggers the endpoint, or gate it behind CAPTCHA and rate limiting to reduce automated exploitation (trade-off: added registration friction). Enforce least-privilege on the CMS database account so a successful injection cannot escalate to full server compromise. Contact the vendor and monitor the INCIBE-CERT notice (https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-megacms-crm-sistemas-de-fidelizacion) and VulDB entry (https://vuldb.com/vuln/360112) for an official patched release before removing these controls.