CVE-2026-2690
Published: 19 February 2026
Summary
CVE-2026-2690 is a medium-severity Injection (CWE-74) vulnerability in Admerc Event Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2690 is a SQL injection vulnerability in the itsourcecode Event Management System 1.0, affecting an unknown functionality within the /admin/ajax.php?action=login endpoint of the Admin Login component. The flaw arises from improper handling of the Username argument, enabling injection attacks. It was published on 2026-02-19 and carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), linked to CWEs-74 and CWE-89.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as unauthorized data access, modification, or disruption within the application's database.
Advisories and details are available via references including VulDB entries (ctiid.346490, id.346490, submit.754239), a GitHub issue at github.com/ltranquility/CVE/issues/39, and the vendor site itsourcecode.com. An exploit has been publicly released and may be actively used.
In notable context, the published exploit increases the risk of real-world exploitation against exposed instances of this event management system.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7625
Vulnerability details
A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Admin Login. This manipulation of the argument Username causes sql injection. It is possible…
more
to initiate the attack remotely. The exploit has been published and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection flaw in unauthenticated public web endpoint directly enables T1190 exploitation of the exposed application; successful injection allows arbitrary DB queries, directly facilitating T1213.006 data collection from the application's database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the Username argument before it reaches the SQL query in /admin/ajax.php?action=login, blocking the injection vector.
Mandates timely remediation of the known SQL-injection flaw in the Event Management System login component once the public exploit is identified.
Enforces access-control decisions on the admin login endpoint so that even a successful injection cannot obtain unauthorized database access.