EUVD Vulnerability Catalog

EUVD-2026-94803

Severity: CRITICAL Base Score: 10 CVSS Version: 4.0

Vulnerability Description

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): Low

▪ Subsequent Confidentiality Impact (SC): High

▪ Subsequent Integrity Impact (SI): High

▪ Subsequent Availability Impact (SA): Low

Affected Vendors & Systems

Vendor NetBoard CRM

References & Advisory Links

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-netboard-crm-demo-platform

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

INCIBE

EPSS Probability

Known Aliases

CVE-2026-12260 GHSA-cjh7-98xw-p5c3

Published On

2026-10-08

Last Updated

2026-10-08