What’s Vulnerable › Vulnerabilities
CVE-2026-3325: SQL injection in MegaCMS by CRM Sistemas de Fidelización
- Severity: critical (CVSS 10.0 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-29 · updated 2026-10-26
- Weakness: CWE-89
Description
SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.
Affected products
References
Get alerted when CVE-2026-3325 or the next vulnerability affects your stack