CVE-2026-53690 describes an SQL Injection vulnerability in Redeight CMS version 1.0. The issue arises because the userEmail parameter in the POST request to /admin/index.php is directly interpolated into SQL queries without proper input sanitization or use of prepared statements. This allows unauthenticated attackers to inject malicious SQL commands remotely, potentially leading to unauthorized data access or database compromise. The vulnerability is classified under CWE-89 and has a critical severity rating with a CVSS 4.0 score of 9.3. No vendor-provided patch or official remediation level is indicated in the available data.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information stored in the database, data modification, or other impacts depending on the database privileges. The vulnerability affects the login endpoint, which may facilitate further unauthorized access or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the userEmail parameter and consider deploying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the /admin/index.php endpoint.