by Kastro
Paper/Archive/CVE-2026-12260

CVE-2026-12260

NetBoard CRM NetBoard CRM Demo Platform — SQL injection in the NetBoard CRM demo platform

EPSS 0.2%CVSS 10.0
critical.is priorityof 100
33
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 13.6.136 × 202.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

Affected

ProductAffectedFixed inSource
NetBoard CRM Demo Platform< 08/10/202608/10/2026CNA

Scores by source

INCIBE (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/sql-injection-netboard-crm-demo-platform