Skip to content
KitploitKITPLOIT
ToolsBlog
Log in
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-30655 — Security advisory for CVE-2026-30655: unauthenticated SQL injection in esiclivre (/reset/index.php). | Kitploit
Tools/GitHubGitHub/brynax/cve-2026-30655
Vulnerability AnalysisExploitationInformation GatheringWeb SecurityDatabase Security
GitHubbrynax/cve-2026-30655

CVE-2026-30655

Security advisory for CVE-2026-30655: unauthenticated SQL injection in esiclivre (/reset/index.php).

View Repository
136 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-30655 — SQL Injection in esiclivre (password reset)

Summary

A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information.

Affected Project

  • Repository: https://github.com/esiclivre/esiclivre
  • Affected versions: v0.2.2 and earlier
  • Affected commit: up to and including 0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7

Technical Details

  • Endpoint: POST /reset/index.php
  • Parameter: cpfcnpj
  • Root cause: user input is concatenated into a SQL query in Solicitante::resetaSenha() without parameterization.

Impact

  • Potential unauthorized access to sensitive database information (information disclosure).

Mitigation / Fix

No upstream fix is available at the time of publication. Recommended remediation:

  • Use parameterized queries (prepared statements) for database access.
  • Validate and sanitize user input.
  • Consider temporarily restricting access to the password reset endpoint until patched.

Timeline

  • 2025-04-12: Reported to vendor/maintainers
  • 2026-02-09: CVE request submitted
  • 2026-03-23: CVE-2026-30655 assigned

Credits

Discovered by Bryan Romero (https://github.com/brynax).

Download Tool