CVE-2026-111472: SQL injection in TSG Profleet
Published Oct 16, 2026
·Updated
An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
Affected Software
1 affected component
TSG Profleet
Event History
Oct 16, 2026
CVE Published
via MITRE·08:37 AM
Data Sourced
via MITRE·08:37 AM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
An attacker needs to be able to send a GET request to the /cgi-bin/index.php endpoint and supply input through its Identificación parameter. The available information does not state whether authentication or other access prerequisites are required.
2
What could an attacker do if exploitation succeeds?
The vulnerability could allow database data to be retrieved, created, updated, or deleted. This creates potential confidentiality, integrity, and availability impact for data stored in the affected database.