CVE-2026-12260
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 08, 2026
Vendor
unknown
Description
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.