{"id":"CVE-2026-13695","published":"2026-10-19T09:17:08.880","lastModified":"2026-10-19T21:03:42.880","description":"SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-integratec-application","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}