CVE-2026-111472

CVSS 9.3 (critical) · published 2026-10-16

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

Weakness: CWE-89

Source: NVD CVE-2026-111472

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.