Vulnerability · Published Feb 3, 2026 · Assigned by INCIBE

CVE-2026-1432SQL injection (SQLi) on the Buroweb platform

Critical 9.3

In plain English

A critical-severity SQL injection in Buroweb from T-Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.

Affected products (as reported)

Vendor	Product	Versions
T-Systems	Buroweb	0 – before 2505.0.13

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:L

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-buroweb-platform patch