CVE-2026-4889 — SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

CVE-2026-4889

SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies PUBLISHED

Description (CNA)

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

Affected (CNA)

Vendor / product	Versions
RDL Technologies / eLoanApp Platform	affected 0 before 06/10/2026

CWE

CWE-89

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-sqli-eloanapp-platform-rdl-technologies

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.