---
id: "CVE-2026-111472"
kind: "vulnerability"
aliases: ["CVE-2026-111472"]
title: "An SQL injection vulnerability has been discovered in TSG Profleet"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Profleet", "fixed": [], "affected": "12.004.01 (INCIBE); CVE record says all versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["internet-facing", "other", "self-hosted", "sql-injection", "tsg-profleet"]
not_affected_if: ["not-internet-exposed"]
published_at: "2026-10-16T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T23:33:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111472", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:33:02+00:00"}]
---

# An SQL injection vulnerability has been discovered in TSG Profleet

TSG Profleet has an SQL injection flaw in the 'Identificación' parameter of the /cgi-bin/index.php endpoint. An attacker can read, create, update and delete data in the backing database with a crafted GET request.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Profleet affected 12.004.01 (INCIBE); CVE record says all versions fixed ?

## How to check

Check whether you run TSG Profleet (fleet refuelling management) and whether version is 12.004.01 (version shown in app/admin UI; unconfirmed where). Check if /cgi-bin/index.php is reachable from the internet and review web logs for GET requests to it with SQL metacharacters in the 'Identificación' parameter.

## Fix

No fix or patched version reported (INCIBE, 2026-10-16). Contact TSG for a patch. Meanwhile restrict /cgi-bin/index.php to trusted networks/VPN or put a WAF rule blocking SQLi on the 'Identificación' parameter.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111472
- 2026-10-23T23:33:02+00:00 analyst — INCIBE-CERT advisory (primary; CNA) names Profleet 12.004.01, no fix reported as of 2026-10-16; CVSS PR:N so unauthenticated per vector, but vendor page not found and not verified by testing. No PoC or exploitation seen; did not search X (niche).

## Documents

- [advisory] SQL injection in TSG Profleet (INCIBE-CERT) https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-tsg-profleet
- [mentions] CVE Record CVE-2026-111472 https://www.cve.org/CVERecord?id=CVE-2026-111472

## From the sources

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_