CVE-2026-12260 — SQL injection in the NetBoard CRM demo platform
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parame…
Published: 2026-10-08 · CVSS: 10.0 · CVSS 4.0
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7