CVE-2026-10731: SQL injection in Nemon products

Synopsis

SQL injection in Nemon Trade Energy (versions 2.95.55) and Nemon Trade Energy CRM (version 2.95.55) allows unauthenticated attackers to inject arbitrary SQL through the 'two_steps_auth_code' parameter in the '/user-login' endpoint. The vulnerable 2FA endpoint is reachable over the network with no prior login required, meaning any attacker who can reach the service can send malicious input directly to the backend database. Successful exploitation gives an attacker full read and write access to the database, the ability to create privileged accounts, and the ability to crash the service. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the '/user-login' endpoint over the network; no physical or local access is needed.

• AuthenticationNot required

  The vulnerable 2FA endpoint is accessible before any login step, so no credentials of any kind are needed.

• Victim interactionNot required

  The attacker sends a crafted request directly to the endpoint; no user action or social engineering is involved.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions, special configurations, or environmental factors required.

Blast Radius

• Reads any data stored in the backend database, including user credentials, session tokens, and business records.
• Creates new privileged user accounts, giving the attacker persistent administrative access to the application.
• Modifies or deletes critical database rows, corrupting application data or erasing audit trails.
• Triggers denial-of-service conditions by issuing resource-exhausting or destructive SQL queries against the database.