Exploitation Summary
EIP tracks 2 public exploits for CVE-2026-30655. PoCs published by SecureWithUmer, brynax.
AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2026-30655, a SQL injection vulnerability in the esiclivre password reset endpoint. The root cause is identified as unsanitized user input concatenated into a SQL query in the `Solicitante::resetaSenha()` function, leading to potential information disclosure.
Description
SQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows unauthenticated remote attackers to gain unauthorized access to sensitive information via the cpfcnpj parameter in /reset/index.php
Exploits (2)
The repository provides a detailed technical analysis of CVE-2026-30655, a SQL injection vulnerability in the esiclivre password reset endpoint. The root cause is identified as unsanitized user input concatenated into a SQL query in the `Solicitante::resetaSenha()` function, leading to potential information disclosure.
Technical writeup detailing a SQL injection vulnerability in esiclivre's password reset endpoint via the `cpfcnpj` parameter. The root cause is improper input sanitization in `Solicitante::resetaSenha()`.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N