CVE Intelligence
Analysis AI-assisted

CVE-2026-1432: Buroweb Platform SQL Injection in tablon Component

A critical SQL injection flaw (CWE-89) affects the tablon component of the Buroweb platform, version 2505.0.12, according to the CNA record. Several parameters do not correctly sanitize user input, which could allow an attacker to run database queries and reach confidential data. The record gives a CVSS 4.0 base score of 9.3 and lists no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes an SQL injection vulnerability (CWE-89) in the tablon component of the Buroweb platform, version 2505.0.12. Several parameters are said not to sanitize user input correctly on one application endpoint. The CVE was published on 2026-02-03 by a CNA, INCIBE-CERT, which also hosts a notice on the issue.

Impact

  • The record states that exploitation could allow an attacker to execute queries against the database.
  • The record states that exploitation could expose confidential information.
  • The CNA assigned a CVSS 4.0 base score of 9.3 (critical). Its vector indicates network reachability, no privileges required, no user interaction, and high confidentiality and integrity impact on the vulnerable system.

Affected products and versions

  • Buroweb platform version 2505.0.12, tablon component, as stated in the record.
  • The record contains no structured affected or fixed version data. Whether other versions are affected is unknown.

Exploitation status

The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. No EPSS score is available in the record.

Remediation and mitigation

  • Consult the INCIBE-CERT notice and contact the vendor to confirm whether an updated release is available for the affected version.
  • Until a fix is confirmed, limit network exposure of the affected application and restrict access to the tablon functionality to trusted users where feasible.
  • Ask the vendor or developers to confirm that database queries use parameterized statements and that the affected parameters are validated.
  • Apply least-privilege permissions to the database account used by the application to reduce the potential impact of data exposure.

Detection guidance

  • Review web server and application logs for unusual or malformed requests to the tablon page of the Buroweb application, particularly requests with abnormal parameter content or database error messages in responses.
  • Monitor for unexpected volumes of data leaving the database or application server.

Limitations of the available information

  • The record does not identify the specific vulnerable parameters.
  • No fixed version, patch or vendor advisory text is included in the record.
  • No public proof of concept or exploitation data is recorded in the sources provided.
  • The CVSS base score comes from the CNA; no other scoring provider is listed.

Frequently asked questions

What is CVE-2026-1432?

It is an SQL injection vulnerability (CWE-89) reported in the tablon component of the Buroweb platform, version 2505.0.12, according to the CNA record.

Is this vulnerability known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Is a fixed version available?

The record does not list any fixed version. Check the INCIBE-CERT notice and the vendor for current guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.