SQL Injection in Nemon Trade Energy
CVE-2026-10731
SQL injection in the ‘two_steps_auth_code’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor authentication (2FA) functionality can be accessed without prior authentication, al…
Vulnerability class: SQL Injection
EPSS: 0.003 (27.5th percentile) — read the EPSS interpretation.
Affected products
- Nemon Trade Energy — versions 2.95.55
- Nemon Trade Energy Crm — versions 2.95.55
Weakness classification (CWE)
References
- cve-coordination@incibe.es (patch)