SQL injection in Atmira’s SIREC
SIREC by Atmira. Affected versions not specified.
INCIBE has coordinated the disclosure of a high severity vulnerability affecting Atmira’s SIREC, a debt collection and recovery management platform. The vulnerability was discovered by Luis Ovejero Martin.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-123087 | CVSS v4.0: 8,7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
Atmira has confirmed that the vulnerability was fixed on 16 October 2026.
CVE-2026-123087: SQL injection vulnerability in Atmira’s SIREC. The server retrieves the value of a field from a JSON object containing user-supplied information and concatenates it into an SQL statement without properly sanitising the input. This allows the original query to be altered via malicious input, causing the database to return unexpected information.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-123087 | Alta | No | ATMIRA |
