CVE-2026-4889

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

• CWE-89

• https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-eloanapp-platform-rdl-technologies

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48884Missing Authorization vulnerability in weDevs WP User Fronte…5.3
• CVE-2026-48885Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2…7.1
• CVE-2026-48886Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versi…9.3
• CVE-2026-48887Unauthenticated Broken Access Control in JS Help Desk <= 3.0…6.5
• CVE-2026-48888Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-48889Subscriber Privilege Escalation in Amelia <= 2.3 versions.8.8
• CVE-2026-48891A bug in Apache Airflow's `/ui/dependencies` scheduling grap…4.3
• CVE-2026-48892The Config API in Apache Airflow surfaced per-key secrets-ba…6.5
• CVE-2026-48895URL Redirection to Untrusted Site ('Open Redirect') vulnerab…7.2
• CVE-2026-48896Insufficient state checks lead to a vector that allows to by…7.5
• CVE-2026-48897Insufficient state checks lead to a vector that allows to by…7.5
• CVE-2026-48898An improper access check allows privilege escalation through…9.8