[ CVE-2026-12260 · Published 8 Oct 2026 ]
Vulnerability in NetBoard CRM Demo Platform
CVSS 10.0
EPSS <1%No fix listed yet
[ Why it matters ]Priority signals
- Critical severity: CVSS 10.0
[ Description ]Official description
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.