{"id":"CVE-2026-13695","kind":"vulnerability","aliases":["CVE-2026-13695"],"related":[],"title":"Integratec application: SQL injection leaks credentials and user data via login","description":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.","summary":"The Integratec application passes the sInfo POST parameter to /login/ap_Login.aspx/start without proper escaping, enabling UNION-based SQL injection. An attacker can read credentials and user data from the database and cause errors or partial denial of service.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Integratec application","fixed":[],"affected":"all released versions (per INCIBE)","ecosystem":"vendor"}],"ecosystems":[],"tags":["asp.net","hr-platform","integratec","login-endpoint","other","sql-injection"],"not_affected_if":["not-using-integratec"],"how_to_check":"Exposed if you run the Integratec talent/HR application (ASP.NET) reachable from the network: it has /login/ap_Login.aspx/start. Vendor version list unknown; INCIBE says all released versions. Check web logs for POSTs to that path with SQL keywords (UNION, SELECT) in sInfo.","fix":"No fix reported as of INCIBE 2026-09-30; fixed version unknown. Contact Integratec. Mitigate: restrict access to the login endpoint (VPN/IP allowlist), put a WAF rule on sInfo, rotate credentials if exposed.","status":"open","published_at":"2026-10-19T09:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:33:16+00:00","updated_at":"2026-10-24T00:22:28+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:33:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Integratec application: SQL injection leaks credentials and user data via login","impact":"high","summary":"The Integratec application passes the sInfo POST parameter to /login/ap_Login.aspx/start without proper escaping, enabling UNION-based SQL injection. An attacker can read credentials and user data from the database and cause errors or partial denial of service.","category":"other","who_cares":["integratec","asp.net","login-endpoint"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads database credentials and user records","analyst_note":"Identify the Integratec product and vendor advisory and the fixed version from the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-13695, and confirm whether login is reachable without authentication.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00077,"input_tokens":2990,"output_tokens":941,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the Integratec product and vendor advisory and the fixed version from the NVD page https://nvd.nist.gov/vuln/detail/CVE-2026-13695, and confirm whether login is reachable without authentication.","search":"'-13695':14A,17A '-2026':13A,16A '/login/ap_login.aspx/start':41B,95C 'affect':85C 'allow':102C 'applic':2A,34B,83C 'application':19A 'asp.net':20B 'attack':52B,104C,138C 'base':48B,78C 'caus':63B,118C 'condit':126C 'could':101C,130C 'credenti':6A,55B,113C 'cve':12A,15A 'data':9A,58B,107C,141C 'databas':61B,110C 'denial':67B,123C 'denial-of-servic':122C 'enabl':45B 'endpoint':27B,94C 'error':64B,119C 'escal':145C 'escap':44B 'exfiltr':142C 'exploit':97C 'facilit':131C 'follow':136C 'follow-up':135C 'furthermor':127C 'hr':22B 'hr-platform':21B 'inform':116C 'inject':4A,31B,50B,71C 'integratec':1A,18A,24B,33B,82C 'leak':5A 'login':11A,26B 'login-endpoint':25B 'paramet':39B,88C 'partial':66B,121C 'pass':35B 'platform':23B 'post':38B,91C 'privileg':144C 'proper':43B 'read':54B 'sent':89C 'servic':69B,125C 'sinfo':37B,87C 'specif':74C 'sql':3A,30B,49B,70C 'sql-inject':29B 'sqli':72C 'steal':106C 'success':96C 'type':133C 'union':47B,77C 'union-bas':46B,76C 'user':8A,57B,115C 'via':10A,90C 'vulner':73C,79C,100C,129C 'without':42B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13695","severity":null,"published_at":"2026-10-19T09:17:08+00:00","modified_at":"2026-10-19T21:03:42+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13695:647","url":null,"severity":null,"published_at":"2026-10-24T00:22:28+00:00","modified_at":"2026-10-24T00:22:28+00:00","first_seen_at":"2026-10-24T00:22:28+00:00","fetched_at":"2026-10-24T00:22:28+00:00","note":"INCIBE-CERT advisory (primary available): pre-auth SQLi (PR:N) on login endpoint, CVSS4 8.8, no fix reported, no exploitation or PoC found, not checked on social. NVD page returned empty; no vendor page found."}],"documents":[{"id":2572,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-integratec-application","title":"SQL Injection in the Integratec Application (INCIBE-CERT)","kind":"advisory","source":"analyst","text":"INCIBE-CERT 2026-09-30: CVE-2026-13695, UNION-based SQLi in Integratec app (talent/HR platform), sInfo POST param at /login/ap_Login.aspx/start. CVSS v4.0 8.8 AV:N/PR:N/UI:N. Solution: none reported. Exploitation: No. Discoverer Christopher Alejandro.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}