CVE-2026-3133
Published: 25 February 2026
Summary
CVE-2026-3133 is a medium-severity Injection (CWE-74) vulnerability in Admerc Document Management System. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-3133 is a SQL injection vulnerability (CWE-74, CWE-89) in itsourcecode Document Management System 1.0. The flaw affects the /loging.php file in the Login component, where manipulation of the Username argument enables the injection.
Remote attackers require no privileges (PR:N), can exploit it over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation yields low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), earning a CVSS v3.1 base score of 7.3; the exploit has been publicly disclosed and may be used.
Advisories provide further details via VulDB entries (ctiid.347616, id.347616, submit.758323), a GitHub issue at https://github.com/ltranquility/CVE/issues/41, and the vendor site at https://itsourcecode.com/. No specific patches or mitigations are detailed in the available information.
The vulnerability was published on 2026-02-25, with public exploit availability indicating potential for real-world use.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8573
Vulnerability details
A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack…
more
is possible. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in publicly accessible /loging.php login component directly enables remote exploitation of a public-facing web application (T1190) for initial access, auth bypass, or limited data manipulation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the Username input in /loging.php to block SQL injection payloads.
Boundary protection devices such as WAFs can inspect and filter SQL injection attempts targeting the login endpoint before they reach the application.
Least-privilege database accounts used by the login component limit the impact of any successful SQL injection.