CVE-2026-7489 - Sunnet｜CTMS - SQL Injection

Back Back to CVE browser

HIGH

Sunnet｜CTMS - SQL Injection

Published May 2, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.55%

Description

CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Affected products

Vendor Sunnet Product CTMS Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sunnet

CTMS

unaffected

Version	Status	Constraints
0	affected	-

Remediation

Vendor solution

The vendor should have issued a patch. If not yet received, please reach out to the vendor directly.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://www.twcert.org.tw/en/cp-139-10895-25ca1-2.html
third-party-advisoryThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10894-1ac1f-1.html
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://www.twcert.org.tw/en/cp-139-10895-25ca1-2.html		third-party-advisoryThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10894-1ac1f-1.html		third-party-advisoryThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner twcert

Published May 2, 2026

Updated May 4, 2026

Reserved Apr 30, 2026

Link CVE-2026-7489

CISA Vulnrichment

Updated May 4, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-7489

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-7489