Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

NetBoard CRM demo can let attackers read or change data

CVE-2026-12260 · published 10 days ago
Summary

The demo version of NetBoard CRM has a flaw in the password‑recovery page that lets a remote user send specially crafted input and view or modify information stored in the system. This could expose details about the underlying database and allow data to be altered or further attacks to be carried out. Apply the vendor’s latest patch or disable the vulnerable recovery feature until it is updated.

What to do
  • Update netboard crm netboard crm demo platform to version 08/10/2026 or later.
Affected software
VendorProductAffected versions
netboard crm netboard crm demo platform < 08/10/2026
Original advisory text
SQL injection in the NetBoard CRM demo platform
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
References
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published8 Oct 2026
Updated15 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-12260 · NVD
CVE-2026-12260 · MITRE
Track software like this
Free during beta