CVE-2026-3325
NONE—CVSS v3
—CVSS v2
0.06%
EPSS (exploit probability)
CWE-89CWE
Description
SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.
Affected routers (0)
No routers currently mapped to this CVE in our database.