CVE-2026-41462: ProjeQtor Unauthenticated SQL Injection in Login

Overview

CVE-2026-41462 affects the login functionality of ProjeQtor, a project management application. According to the record, the login variable is concatenated directly into a SQL query without parameterization or sanitization, a weakness classified as CWE-89 (SQL Injection).

Impact

• The record states that an attacker can inject SQL expressions through the username field at the authentication endpoint without being authenticated.
• The description lists possible consequences: creating privileged accounts, reading sensitive data, and executing operating system commands when the database user has elevated permissions.
• The CVSS 3.1 base score is 9.8 (critical). Its vector indicates network reachability, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
• The CVSS 4.0 score in the record is 9.3, provided by the CNA VulnCheck.

Affected products and versions

• Product: ProjeQtor.
• Range stated in the description: versions 7.0 through 12.4.3.
• The structured affected and fixes lists in the record are empty, so the range above comes from the description text only.
• Whether versions outside this range are affected is unknown from the available data.

Exploitation status

• The record shows that the vulnerability is not listed in the CISA KEV catalog.
• No confirmed exploitation in the wild appears in the sources consulted.
• The EPSS probability in the record is 0.00658 with a percentile of 0.50151. EPSS estimates the likelihood of exploitation activity and does not confirm it.

Remediation and mitigation

• The record does not identify a fixed version. Check the ProjeQtor website and the VulnCheck advisory for vendor guidance.
• Until a fix is confirmed, limit exposure of the login endpoint: restrict access to trusted networks, place it behind a controlled access layer, and review whether it is reachable from the internet.
• Apply least privilege to the database account used by the application, so that a flaw in the login path cannot easily reach operating system functions or sensitive administrative data.
• Review existing user accounts for unexpected administrative entries.

Detection guidance

• Monitor authentication logs for unusual or malformed username values and for bursts of failed logins from a single source.
• Audit database activity for unexpected queries originating from the application account.
• Periodically review the list of privileged application accounts and alert on newly created ones.

Limitations of the available information

• The record contains no fixed version, patch identifier, or structured affected-product data.
• Exact exploit conditions, database configuration and deployment context are not described.
• The CVSS 3.1 and 4.0 scores come from the CNA, and no other provider assessment is present in the record.

Frequently asked questions

Is CVE-2026-41462 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority because of its critical severity.

Which ProjeQtor versions are affected?

The description identifies versions 7.0 through 12.4.3. The structured affected list in the record is empty, so confirm your exact version against the vendor information.

Is a fixed version available?

The record does not identify a fixed version. Check the ProjeQtor website and the VulnCheck advisory for updates, and restrict access to the login endpoint until guidance is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.