by Kastro
Paper/Archive/CVE-2026-111472

CVE-2026-111472

TSG Profleet — SQL injection in TSG Profleet

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 16.2.162 × 203.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

Affected

ProductAffectedFixed inSource
Profleet< 16/10/202616/10/2026CNA

Scores by source

INCIBE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet