Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that do not correctly sanitize user input in the endpoint '/sta/CarpetaPublic/doEvent?APP_CODE=STA&PAGE_CODE=TABLON'. Exploiting this vulnerability could allow an attacker to execute queries on the database and gain access to confidential information.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
⚠️#INCIBEaviso | Inyección SQL (SQLi) en la plataforma #Buroweb #CVE #CVE-2026-1432 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-sql-sqli-en-la-plataforma-buroweb #AvisosDeSeguridad #TI #CNA #0day https://t.co/PkoO3rPeGf
Post summary
The tweet announces a SQL injection vulnerability (CVE‑2026‑1432) affecting the Buroweb platform and directs readers to an official INCIBE security alert.
CVE-2026-1432 SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several parameters that … https://www.cve.org/CVERecord?id=CVE-2026-1432
Post summary
The tweet announces CVE‑2026‑1432 as an SQL injection in the Buroweb platform’s tablon component, without providing further technical depth or mitigation details.
🚨 CVE-2026-1432: SQL injection (SQLi) on the Burow... Buroweb's '/sta/CarpetaPublic/doEvent' endpoint exposes unauthenticated SQLi in multiple parameters, enabling trivial DB... https://zerodaysignal.com/vulnerability/CVE-2026-1432 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces a new SQL injection vulnerability in Buroweb’s endpoint, includes a link likely containing PoC details, but no evidence of exploitation, patches, or false positives.