Vulnerability · Published Apr 27, 2026 · Assigned by VulnCheck

CVE-2026-41462ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login

Critical 9.8

In plain English

A critical-severity SQL injection in ProjeQtor from ProjeQtor. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.

Affected products (as reported)

Vendor	Product	Versions
ProjeQtor	ProjeQtor	7.0 – through 12.4.3

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://damiri.fr/en/cves/CVE-2026-41462 technical-description, exploit
https://gryfman.fr/cves/CVE-2026-41462 technical-description, exploit
https://www.projeqtor.com product
https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login third-party-advisory