CVE-2020-26944

CRITICAL 9.8CVE-2020-26944 · Published 16/10/2020 · updated 17/06/2026

In short

CVE-2020-26944 is a CRITICAL (CVSS 9.8) vulnerability affecting product configurator (aptean).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
product configurator aptean	`= 4.61.0000`	No fix yet

Description

An issue was discovered in Aptean Product Configurator 4.61.0000 on Windows. A Time based SQL injection affects the nameTxt parameter on the main login page (aka cse?cmd=LOGIN). This can be exploited directly, and remotely.

References

aptean.com · Vendor Advisory
logicallysecure.com/blog/sql-injection-in-aptean · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free