CVE-2026-53690: Redeight CMS SQL Injection in Admin Login via userEmail Parameter
CVE-2026-53690 is an SQL injection flaw in Redeight CMS version 1.0. The userEmail field in the POST login request to /admin/index.php is concatenated into SQL queries without sanitization or prepared statements. The CNA cvd@cert.pl rates it 9.3 under CVSS 4.0, and the record reports no confirmed exploitation.
Overview
CVE-2026-53690 describes an SQL injection flaw in Redeight CMS version 1.0. The issue lies in the login handling of the POST request to /admin/index.php, where the userEmail parameter is placed into SQL queries without sanitization or parameterized statements. The record is classified as CWE-89 and was published by the CNA cvd@cert.pl, with the advisory hosted by CERT Polska.
Impact
- According to the record, an unauthenticated remote attacker could execute arbitrary SQL commands and extract sensitive database information.
- The CVSS 4.0 score of 9.3 reflects high impact on confidentiality and integrity of the vulnerable system and low impact on availability. The record reports no impact on subsequent systems.
- Inference: exposure of database contents, such as account records, could make further compromise of the administrative area easier, but the sources do not describe what data the database holds.
Affected products and versions
- Product: Redeight CMS.
- Version explicitly named in the record: 1.0.
- The record does not provide a structured list of affected versions or products. Whether other versions are affected is unknown.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS estimate is about 0.51% probability with a percentile of about 42, which is a statistical estimate and not evidence of exploitation in the wild.
Remediation and mitigation
- The record lists no fixed version. The absence of a listed fix does not mean that no fix exists, so check the vendor and the CERT Polska advisory for updates.
- If no fix is available, restrict access to the administrative login path to trusted networks, and consider whether the CMS can be replaced or removed from public exposure.
- Where the code is maintained internally, adopt parameterized queries and strict input validation for all login fields.
- Limit the database account used by the application to the minimum permissions it needs.
Detection guidance
- Review web server and application logs for unusual POST requests to the admin login endpoint, especially requests with abnormal or unusually long values in the userEmail field.
- Monitor database logs for errors or query patterns that originate from the web application account and do not match normal operation.
- Treat repeated or unexplained login attempts against the admin area as priority events for investigation.
Limitations of the available information
The record gives no fixed versions, no vendor advisory beyond the CERT Polska post, no complete list of affected products or versions, and no exploitation timeline. The CVSS 4.0 score comes from the CNA; the source record shows no other scoring provider. The source status is Deferred. This analysis does not include technical exploitation details, and the exact vulnerable code path is not described in the available sources. Full references are available in the NVD entry.
Frequently asked questions
What is CVE-2026-53690?
It is an SQL injection vulnerability in Redeight CMS version 1.0, triggered through the userEmail parameter of the POST login request to /admin/index.php, according to the record.
Does the record show active exploitation?
No. The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version?
The record does not list a fixed version. This does not mean no fix exists, so check the vendor and the CERT Polska advisory for updates.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.