Vulnerability · Published Jun 30, 2026 · Assigned by CERT-PL

CVE-2026-53690SQL Injection in Redeight CMS

Critical 9.3

In plain English

A critical-severity SQL injection in Redeight CMS from Redeight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application fails to sanitize user input and directly interpolates it into SQL queries without using prepared statements, which allows unauthenticated remote attackers to execute arbitrary SQL commands and extract sensitive database information.

Affected products (as reported)

Vendor	Product	Versions
Redeight	Redeight CMS	1.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://cert.pl/posts/2026/06/CVE-2026-53690 third-party-advisory