CVE-2026-3325

SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the registration form is submitted, could be manipulated by an unauthenticated attacker to execute arbitrary SQL queries.

• CWE-89

• https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-megacms-crm-sistemas-de-fidelizacion

Published

Apr 29, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33244React Router is a router for React. In versions 7.5.1 throug…5.4
• CVE-2026-33245React Router is a router for React. In versions 7.7.0 throug…4.7
• CVE-2026-33246NATS-Server is a High-Performance server for NATS.io, a clou…5.4
• CVE-2026-33247NATS-Server is a High-Performance server for NATS.io, a clou…5.3
• CVE-2026-33248NATS-Server is a High-Performance server for NATS.io, a clou…4.2
• CVE-2026-33249NATS-Server is a High-Performance server for NATS.io, a clou…4.3
• CVE-2026-33250Freeciv21 is a free open source, turn-based, empire-building…7.5
• CVE-2026-33251Discourse is an open-source discussion platform. Prior to ve…5.4
• CVE-2026-33252The Go MCP SDK used Go's standard encoding/json. Prior to ve…6.5
• CVE-2026-33253SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers …8.4
• CVE-2026-33254An attacker can create a large number of concurrent DoQ or D…7.5
• CVE-2026-33256An attacker can send a web request that causes unlimited mem…7.5