[ CVE-2026-13695 · Published 19 Oct 2026 ]
Vulnerability in Integratec
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerability could allow an attacker to steal data from the database, such as credentials and user information, and cause errors and partial denial-of-service conditions. Furthermore, this vulnerability could facilitate other types of follow-up attacks, such as data exfiltration or privilege escalation.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.