Vulnerability · Published Oct 6, 2026 · Assigned by INCIBE

CVE-2026-4889SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

High 7.8

In plain English

A high-severity SQL injection in eLoanApp Platform from RDL Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 4.0)7.8High

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

Affected products (as reported)

Vendor	Product	Versions
RDL Technologies	eLoanApp Platform	0 – before 06/10/2026

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-eloanapp-platform-rdl-technologies