External risk intelligence

Redeight CMS SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-53690

The vulnerability exists in a login endpoint (/admin/index.php) of a content management system. CMS platforms and their administrative interfaces are commonly deployed as internet-facing web applications to allow for remote management and user access, making this endpoint frequently exposed to the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An SQL Injection vulnerability exists in a content management system, allowing unauthenticated attackers to execute arbitrary SQL commands. This could potentially lead to the extraction of sensitive database information by exploiting the application's failure to properly sanitize user input in its login endpoint.

Input flaws can expose database information.
Login endpoints are often internet-facing.
Confirm relevance and exposure of the system.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable login endpoint of Redeight CMS over the internet. By sending a specially crafted request to the `/admin/index.php` endpoint, an unauthenticated remote attacker can inject malicious SQL commands through the `userEmail` parameter. This could lead to the execution of arbitrary SQL commands, potentially exposing sensitive database information.

No authentication required to access.
Input sent to login endpoint parameter.
Sensitive database information disclosure.

Live Threat

Current exploitation, exposure, and threat context

An SQL Injection vulnerability in Redeight CMS could allow unauthenticated remote attackers to execute arbitrary SQL commands. This could potentially lead to the extraction of sensitive database information when the "userEmail" parameter in the "/admin/index.php" login endpoint is exploited.

Database information could be at risk.
Unauthenticated remote attackers may exploit the parameter.
Sensitive data extraction may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Redeight CMS administrative interface, particularly its login endpoint, is likely managed by the application owner or a dedicated platform team. The initial step involves identifying all instances of this CMS, assessing their exposure and criticality, and locating the accountable system owner for each. Following this, a risk-based remediation plan can be developed.

Confirm application and infrastructure ownership.
Verify reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Redeight CMS?

Redeight CMS is a software platform used for content management, typically providing web-based interfaces that allow users to create, modify, and organize digital content. Like many content management systems, it includes administrative panels to manage site settings and user accounts, which often serve as the central hub for overseeing the website's operations.

What does CVE-2026-53690 mean for system security?

This vulnerability is classified as SQL Injection (CWE-89). It occurs when the software takes user-provided data and inserts it directly into database queries without proper filtering. Because the application fails to separate the commands from the data, an attacker can manipulate these queries to access or extract sensitive information directly from the underlying database.

How is this SQL injection triggered?

An attacker triggers the vulnerability by sending a specially crafted request to the login page of the administrative interface. The flaw specifically resides in how the system processes the 'userEmail' parameter. Notably, this does not require an attacker to have a valid account or pre-existing credentials, as the weakness is exposed on the login endpoint itself before authentication occurs.

Is my instance of Redeight CMS at risk?

Halo Surface Signal indicates that administrative login endpoints for content management systems are frequently deployed as internet-facing services to facilitate remote management. If your administrative console is accessible over the public internet, it falls into a high-risk category for this vulnerability because it can be reached by unauthorized remote actors without requiring internal network access.

What should I do if I run Redeight CMS?

Start by identifying all deployed instances of the software within your environment and confirming who is responsible for managing them. Assess the network visibility of the administrative login page to see if it is exposed publicly. Once you have mapped your assets and their ownership, you can prioritize remediation efforts based on the specific business criticality of those systems.

References

cert.pl/posts/2026/06/CVE-2026-53690

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.