CVE-2026-13695 SQL Injection in the Integratec Application
An attacker can exploit a SQL injection flaw in the login endpoint to steal database credentials and user information, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-13695?
CVE-2026-13695 is a high-severity SQL injection vulnerability in Integratec, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
Weakness: CWE-89
Which versions are affected by CVE-2026-13695?
How do I fix CVE-2026-13695?
No fix has been published for CVE-2026-13695 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-13695 being exploited?
There is no known exploitation of CVE-2026-13695 in the wild and no public exploit code.
Sources
Also known as GHSA-c2vh-7336-w495.