---
id: "CVE-2026-13695"
kind: "vulnerability"
aliases: ["CVE-2026-13695"]
title: "Integratec application: SQL injection leaks credentials and user data via login"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Integratec application", "fixed": [], "affected": "all released versions (per INCIBE)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["asp.net", "hr-platform", "integratec", "login-endpoint", "other", "sql-injection"]
not_affected_if: ["not-using-integratec"]
published_at: "2026-10-19T09:17:08+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-24T00:22:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13695", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:22:28+00:00"}]
---

# Integratec application: SQL injection leaks credentials and user data via login

The Integratec application passes the sInfo POST parameter to /login/ap_Login.aspx/start without proper escaping, enabling UNION-based SQL injection. An attacker can read credentials and user data from the database and cause errors or partial denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Integratec application affected all released versions (per INCIBE) fixed ?

## How to check

Exposed if you run the Integratec talent/HR application (ASP.NET) reachable from the network: it has /login/ap_Login.aspx/start. Vendor version list unknown; INCIBE says all released versions. Check web logs for POSTs to that path with SQL keywords (UNION, SELECT) in sInfo.

## Fix

No fix reported as of INCIBE 2026-09-30; fixed version unknown. Contact Integratec. Mitigate: restrict access to the login endpoint (VPN/IP allowlist), put a WAF rule on sInfo, rotate credentials if exposed.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-13695
- 2026-10-24T00:22:28+00:00 analyst — INCIBE-CERT advisory (primary available): pre-auth SQLi (PR:N) on login endpoint, CVSS4 8.8, no fix reported, no exploitation or PoC found, not checked on social. NVD page returned empty; no vendor page found.

## Documents

- [advisory] SQL Injection in the Integratec Application (INCIBE-CERT) https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-integratec-application

## From the sources

SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_