Live › vulnerability › CVE-2026-13695
Go to dashboardThe Integratec application passes the sInfo POST parameter to /login/ap_Login.aspx/start without proper escaping, enabling UNION-based SQL injection. An attacker can read credentials and user data from the database and cause errors or partial denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Integratec application | vendor | all released versions (per INCIBE) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
This page as .md · .json · in your agent: get_signal("CVE-2026-13695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.