What’s Vulnerable › Vulnerabilities
CVE-2026-1432: SQL injection (SQLi) on the Buroweb platform
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-03 · updated 2026-06-17
- Weakness: CWE-89
Description
SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.
Affected products
- T-Systems Buroweb: before 2505.0.13 — fixed in 2505.0.13
How to fix
Upgrade to a fixed version: T-Systems Buroweb 2505.0.13. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-1432 or the next vulnerability affects your stack