Critical severity · published Feb 3, 2026
CVE-2026-1432
SQL injection (SQLi) on the Buroweb platform
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BU
Buroweb · T-Systems
before 2505.0.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1432
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1432
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-buroweb-platform
More from Buroweb
6.0
CVE-2026-7185
Unauthorized access to files in T-Systems products