CVE-2026-30995 Details
Description
Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.
A SQL injection vulnerability has been identified in Slah CMS versions through 1.5.0. The issue arises in the vereador_ver.php endpoint, where the id parameter is not properly sanitized before being included in a SQL query. This flaw allows remote attackers to inject malicious SQL commands, potentially leading to unauthorized access and exfiltration of database information, including sensitive administrative data.
Users are advised to update Slah CMS to the latest patched version. The application should also be refactored to use parameterized queries instead of string concatenation for SQL command construction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 15, 2026CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30995 | [email protected] | AdvisoryExploitRemedy |
| https://cve.joaopaulodeoliveira.dev/cve.php/reserved/slah-informatica-sql-injection | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Slah CMS | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | New CVE Received | [email protected] |