CVE-2026-41462
Published: 27 April 2026
Description
ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field…
more
at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection by requiring validation and sanitization of the unauthenticated username input before concatenation into login SQL queries.
Remediates the specific SQL injection flaw in ProjeQtor's login functionality through timely patching or code fixes like query parameterization.
Limits damage from successful SQL injection by enforcing least privilege on the database user account, restricting creation of privileged accounts and OS command execution.
Security SummaryAI
CVE-2026-41462 is an unauthenticated SQL injection vulnerability (CWE-89) affecting ProjeQtor project management software in versions 7.0 through 12.4.3. The flaw resides in the login functionality, where the "login" variable from the username field is directly concatenated into a SQL query without parameterization or sanitization at the authentication endpoint. Published on 2026-04-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high confidentiality, integrity, and availability impacts.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By injecting arbitrary SQL expressions via the username field during login attempts, adversaries can create privileged database accounts, extract sensitive data such as user credentials or application data, and potentially execute operating system commands if the underlying database user possesses elevated permissions.
Advisories and references, including those from VulnCheck (https://www.vulncheck.com/advisories/projeqtor-unauthenticated-sql-injection-via-login), Damiri (https://damiri.fr/en/cves/CVE-2026-41462), Gryfman (https://gryfman.fr/cves/CVE-2026-41462), and the vendor site (https://www.projeqtor.com), provide additional details on the issue; security practitioners should consult these for patch availability and mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unauthenticated SQL injection in the login endpoint of public-facing ProjeQtor software directly enables remote exploitation of public-facing applications for initial access, credential/data extraction, and potential OS command execution.