CVE-2026-3325 — SQL injection in MegaCMS by CRM Sistemas de Fidelización
SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from ina…
Published: 2026-04-29 · CVSS: 10.0 · CVSS 4.0
SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7