{"id":"CVE-2026-12260","published":"2026-10-08T09:16:41.087","lastModified":"2026-10-08T21:04:18.423","description":"SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-netboard-crm-demo-platform","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}