CVE-2026-53690

SQL Injection in Redeight CMS

CVSS 9.3 CRITICALEPSS 0.4%CWE-89

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

30 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application fails to sanitize user input and directly interpolates it into SQL queries without using prepared statements, which allows unauthenticated remote attackers to execute arbitrary SQL commands and extract sensitive database information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Affected products

Redeight · Redeight CMS

References

https://cert.pl/posts/2026/06/CVE-2026-53690