Which versions of eLoanApp Platform are affected by EUVD-2026-93227?

A high-severity flaw in the RDL Technologies eLoanApp Platform exposes the loan application's user-verification endpoint to unauthenticated database injection, meaning an outside party could reach…. A patch is available.

How to fix or mitigate EUVD-2026-93227?

Within 24 hours, confirm which eLoanApp Platform instances are internet-facing, restrict network access to the AJAX user-verification endpoint to trusted sources where operationally feasible, and enable enhanced logging and alerting on that endpoint to catch injection attempts; also request a status update from RDL Technologies on a fix since no vendor-released patch has been identified at time of analysis. Within 7 days, deploy a web application firewall or equivalent input-validation control in front of the endpoint with rules tuned to boolean- and time-based SQL injection patterns, verify that the application's database account runs with least privilege, and review database logs for anomalous delays or unexpected query patterns. Within 30 days, apply the vendor patch as soon as RDL Technologies releases it, and if none is forthcoming, evaluate compensating architectural controls such as virtual patching, isolating the eLoanApp database, or migrating to a supported release; document residual risk acceptance for any exposure that cannot be remediated.

eLoanApp Platform EUVD-2026-93227

Q: What is the CVSS score of EUVD-2026-93227?

EUVD-2026-93227 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-4889 HIGH

SQL Injection (CWE-89)

2026-10-06 INCIBE

GHSA-529h-q2cj-gj6w

PHP SQLi Eloanapp Platform

7.8

CVSS 4.0 · Vendor: INCIBE

Severity by source

Vendor (INCIBE) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Unauthenticated network-reachable injection (AV:N/AC:L/PR:N/UI:N); impacts kept LOW to match the advisory's blind fingerprinting/delay description, though blind SQLi could justify higher C.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (INCIBE).

CVSS VectorVendor: INCIBE

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

Analysis Generated

Oct 06, 2026 - 09:05 vuln.today

CVE Published

Oct 06, 2026 - 08:16 cve.org

HIGH 7.8

DescriptionCVE.org

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

Articles & Coverage 1

News 10 New PHP Vulnerabilities - 3 Critical, 7 High Severity Oct 07, 2026

AnalysisAI

Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network access to the application's AJAX user-verification endpoint '/ajax/users.php' with the request parameter 'op=verify', targeting the 'logina' POST field; this endpoint appears to be part of the pre-authentication login/verify flow, so per the CVSS PR:N value no credentials are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are mixed and point to a moderate, not top-tier, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, confirm which eLoanApp Platform instances are internet-facing, restrict network access to the AJAX user-verification endpoint to trusted sources where operationally feasible, and enable enhanced logging and alerting on that endpoint to catch injection attempts; also request a status update from RDL Technologies on a fix since no vendor-released patch has been identified at time of analysis. …

Threat intelligence, references, and detailed analysis are available after sign-in.