CVE-2026-53690criticalCWE-89

CVE-2026-53690: critical vulnerability in Redeight CMS

SQL Injection in Redeight CMS

Published

Follow this CVE+ Monitor Redeight CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application fails to sanitize user input and directly interpolates it into SQL queries without using prepared statements, which allows unauthenticated remote attackers to execute arbitrary SQL commands and extract sensitive database information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
Redeight · Redeight CMS
Related CVEs — Redeight CMS

In the same product, most dangerous first.

CVE-2026-53691HIGHRemote Code Execution in Redeight CMSEPSS 0.7%CVE-2026-53692MEDIUMWeak hashing algorithm in Redeight CMSEPSS 0.1%