Vulnerability · Published Oct 8, 2026 · Assigned by INCIBE
CVE-2026-12260SQL injection in the NetBoard CRM demo platform
Critical 10.0
In plain English
A critical-severity SQL injection in NetBoard CRM Demo Platform from NetBoard CRM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NetBoard CRM | NetBoard CRM Demo Platform | 0 – before 08/10/2026 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L