CVE-2026-3325

CriticalCVSS 10.0/10Last modified Oct 26, 2026

Description

SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.

Metrics

CVSS 4.0 10.0/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 29, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-332507.5Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiviCVE-2026-332515.4Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerCVE-2026-332526.5The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cCVE-2026-332538.4SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths. A user with the write permission on tCVE-2026-332547.5An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memory allocation in DNSdist and leading to aCVE-2026-332567.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The iCVE-2026-332577.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The iCVE-2026-332587.5By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.CVE-2026-332595.0Having many concurrent transfers of the same RPZ can lead to inconsistent RPZ data, use after free and/or a crash of the recursor. Normally CVE-2026-33268.6The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX actCVE-2026-332607.5An attacker can send a web request that causes unlimited memory allocation in the internal web server, leading to a denial of service. The iCVE-2026-332615.9A zone transition from NSEC to NSEC3 might trigger an internal inconsistency and cause a denial of service.