{"id":"CVE-2026-111472","kind":"vulnerability","aliases":["CVE-2026-111472"],"related":[],"title":"An SQL injection vulnerability has been discovered in TSG Profleet","description":"An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.","summary":"TSG Profleet has an SQL injection flaw in the 'Identificación' parameter of the /cgi-bin/index.php endpoint. An attacker can read, create, update and delete data in the backing database with a crafted GET request.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Profleet","fixed":[],"affected":"12.004.01 (INCIBE); CVE record says all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["internet-facing","other","self-hosted","sql-injection","tsg-profleet"],"not_affected_if":["not-internet-exposed"],"how_to_check":"Check whether you run TSG Profleet (fleet refuelling management) and whether version is 12.004.01 (version shown in app/admin UI; unconfirmed where). Check if /cgi-bin/index.php is reachable from the internet and review web logs for GET requests to it with SQL metacharacters in the 'Identificación' parameter.","fix":"No fix or patched version reported (INCIBE, 2026-10-16). Contact TSG for a patch. Meanwhile restrict /cgi-bin/index.php to trusted networks/VPN or put a WAF rule blocking SQLi on the 'Identificación' parameter.","status":"open","published_at":"2026-10-16T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:08:54+00:00","updated_at":"2026-10-23T23:33:02+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:08:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","impact":"high","summary":"TSG Profleet has an SQL injection flaw in the 'Identificación' parameter of the /cgi-bin/index.php endpoint. An attacker can read, create, update and delete data in the backing database with a crafted GET request.","category":"other","who_cares":["tsg-profleet"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads, alters and deletes all database records via GET request","analyst_note":"Find the vendor advisory or patched Profleet version and confirm whether the endpoint is reachable unauthenticated; NVD link has no version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000424,"input_tokens":2761,"output_tokens":296,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched Profleet version and confirm whether the endpoint is reachable unauthenticated; NVD link has no version range.","search":"'-111472':13A,16A '-2026':12A,15A '/cgi-bin/index.php':44B,101C 'allow':77C 'attack':47B,79C 'back':57B 'could':76C 'craft':61B 'creat':50B,82C 'cve':11A,14A 'data':54B,86C 'databas':58B,89C 'delet':53B,85C 'discov':7A,70C 'endpoint':45B,102C 'face':20B 'flaw':37B 'get':62B,93C 'host':24B 'identificación':40B,97C 'inject':3A,27B,36B,66C 'internet':19B 'internet-fac':18B 'paramet':41B,98C 'profleet':10A,17A,30B,32B,73C 'read':49B 'request':63B,94C 'retriev':81C 'self':23B 'self-host':22B 'send':91C 'sql':2A,26B,35B,65C 'sql-inject':25B 'tsg':9A,29B,31B,72C 'tsg-profleet':28B 'updat':51B,83C 'use':95C 'vulner':4A,67C,75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111472","severity":null,"published_at":"2026-10-16T09:17:04+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111472:468","url":null,"severity":null,"published_at":"2026-10-23T23:33:02+00:00","modified_at":"2026-10-23T23:33:02+00:00","first_seen_at":"2026-10-23T23:33:02+00:00","fetched_at":"2026-10-23T23:33:02+00:00","note":"INCIBE-CERT advisory (primary; CNA) names Profleet 12.004.01, no fix reported as of 2026-10-16; CVSS PR:N so unauthenticated per vector, but vendor page not found and not verified by testing. No PoC or exploitation seen; did not search X (niche)."}],"documents":[{"id":2033,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet","title":"SQL injection in TSG Profleet (INCIBE-CERT)","kind":"advisory","source":"analyst","text":"Affected: TSG Profleet version 12.004.01. Solution: No solution has been reported as yet. CVE-2026-111472, CVSS v4.0 9.3, CWE-89, PR:N. Discovered by Rubén Barrios. Exploitation: No.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2034,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111472","title":"CVE Record CVE-2026-111472","kind":"other","source":"analyst","text":"CNA INCIBE. Affected from 0 before 16/10/2026 (no real version range). CWE-89. CVSS 4.0 9.3.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}