SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'.
CVSS 4.0HIGH 7.8·Network·No auth·No interaction·EPSS 0.00299·Published 2026-10-06·Fixed in 06/10/2026CWE-89