CriticalCritical vulnerability

CVE-2026-111472 (CVSS 9.3)

NVD · officialPublished Oct 16, 2026Risk 50/100EPSS 0.2%

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

Technical details

CVSS

9.3

AV:NetworkAC:LowPR:NoneUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source