CVE-2026-125612 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Deltaww DIAEnergie, an energy management application, fails to neutralize special characters in SQL commands, so input can alter database queries. An attacker who can reach the application can read or change the data it stores.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organisations running DIAEnergie versions before 1.11.01.032 are exposed. The sources do not say which deployment setups or network exposure make it reachable, so the team should check where the application is reachable from.
Not affected if patched-version
Who cares deltaww, diaenergie, energy-management
1.11.01.0321.11.01.032 or laterImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.
This issue affects DIAEnergie: before 1.11.01.032.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.