CVE-2026-111472
9.3CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Remote unauthenticated attackers can read, modify, or delete the entire database over the network. They only need HTTP access to send a crafted GET request.
Root cause
The application fails to sanitize user input passed to the 'Identificación' GET parameter in '/cgi-bin/index.php' before executing SQL queries.
Affected systems
TSG Profleet (versions not listed — check the vendor advisory).
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Apply the vendor patch for TSG Profleet once available. Until patched, block external access to '/cgi-bin/index.php' or place the application behind a WAF filtering the 'Identificación' parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.