CVE-2026-22197: GestSup < 3.2.60 Multiple SQL Injections in Asset List
GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22197?
CVE-2026-22197 has been classified with a high severity rating due to its potential for unauthorized data access.
How do I fix CVE-2026-22197?
To fix CVE-2026-22197, upgrade GestSup to version 3.2.57 or later, which addresses the SQL injection vulnerabilities.
What are the potential impacts of CVE-2026-22197?
The potential impacts of CVE-2026-22197 include data breaches, unauthorized data modification, and system compromise.
Who is affected by CVE-2026-22197?
CVE-2026-22197 affects all users of GestSup versions up to and including 3.2.56.
What type of vulnerability is CVE-2026-22197?
CVE-2026-22197 is classified as a SQL injection vulnerability within the asset list functionality of GestSup.