CVE-2026-111472CWE-89sql-injection

CVE-2026-111472

published October 16, 2026

CVSS
9.3
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-16T13:17Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 08:37Z
    SQL injection in TSG Profleet
    cvelistv5
  • 16 OCT 08:37Z
    SQL injection in TSG Profleet
    cvelistv5