CVE-2026-41462 Details

A critical unauthenticated SQL injection vulnerability has been identified in ProjeQtor versions 7.0 prior to 12.4.4. The vulnerability arises in the login functionality, where the login variable is directly concatenated into a SQL query without proper parameterization or sanitization. This flaw allows attackers to inject arbitrary SQL expressions through the username field at the authentication endpoint. Exploitation of this vulnerability could lead to the creation of privileged accounts, unauthorized access to sensitive data, and execution of operating system commands, depending on the database user's permissions.

Users are advised to update ProjeQtor to version 12.4.4 or later. The vulnerability can also be mitigated by ensuring that the application database user has limited privileges and by using parameterized queries or prepared statements for SQL database interactions.