{"id":"CVE-2026-125612","kind":"vulnerability","aliases":["CVE-2026-125612"],"related":[],"title":"Deltaww DIAEnergie: SQL injection flaw before version 1.11.01.032","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.\n\nThis issue affects DIAEnergie: before 1.11.01.032.","summary":"Deltaww DIAEnergie, an energy management application, fails to neutralize special characters in SQL commands, so input can alter database queries. An attacker who can reach the application can read or change the data it stores.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["deltaww","diaenergie","energy-management","infrastructure"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed DIAEnergie version in the application's about or version screen, and compare it with `1.11.01.032`","fix":"- DIAEnergie: move to `1.11.01.032` or later","status":"open","published_at":"2026-11-10T03:16:42+00:00","first_seen_at":"2026-11-10T03:19:23+00:00","triaged_at":"2026-11-10T03:19:47+00:00","updated_at":"2026-11-10T03:19:47+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T03:19:47Z","model":"claude-haiku-5-5","output":{"fix":"- DIAEnergie: move to `1.11.01.032` or later","reach":"unknown","title":"Deltaww DIAEnergie: SQL injection flaw before version 1.11.01.032","impact":"high","summary":"Deltaww DIAEnergie, an energy management application, fails to neutralize special characters in SQL commands, so input can alter database queries. An attacker who can reach the application can read or change the data it stores.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["diaenergie","deltaww","energy-management"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads or alters the application's database contents","analyst_note":"Confirm whether the SQL injection is reachable without authentication and which interfaces expose it; the NVD entry gives no further detail.","how_to_check":"- Check the installed DIAEnergie version in the application's about or version screen, and compare it with `1.11.01.032`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Organisations running DIAEnergie versions before 1.11.01.032 are exposed. The sources do not say which deployment setups or network exposure make it reachable, so the team should check where the application is reachable from.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4530,"output_tokens":492,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125612':11A,14A '-2026':10A,13A '1.11.01.032':8A,80C 'affect':77C 'allow':72C 'alter':38B 'applic':26B,47B 'attack':42B 'chang':51B 'charact':31B 'command':34B,65C 'cve':9A,12A 'data':53B 'databas':39B 'deltaww':1A,15B,21B,70C 'diaenergi':2A,16B,22B,71C,78C 'element':60C 'energi':18B,24B 'energy-manag':17B 'fail':27B 'flaw':5A 'improp':56C 'infrastructur':20B 'inject':4A,67C,74C 'input':36B 'issu':76C 'manag':19B,25B 'neutral':29B,57C 'queri':40B 'reach':45B 'read':49B 'special':30B,59C 'sql':3A,33B,64C,66C,73C 'store':55B 'use':61C 'version':7A 'vulner':68C","nicknames":[],"mitigations":[],"who_affected":"Organisations running DIAEnergie versions before 1.11.01.032 are exposed. The sources do not say which deployment setups or network exposure make it reachable, so the team should check where the application is reachable from.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["deltaww","diaenergie","energymanagement","high","infrastructure"],"campaign_type":null,"search_a":"'-125612':11A,14A '-2026':10A,13A '1.11.01.032':8A 'cve':9A,12A 'deltaww':1A 'diaenergi':2A 'flaw':5A 'inject':4A 'sql':3A 'version':7A","search_b":"'alter':38B 'applic':26B,47B 'attack':42B 'chang':51B 'charact':31B 'command':34B 'data':53B 'databas':39B 'deltaww':15B,21B 'diaenergi':16B,22B 'energi':18B,24B 'energy-manag':17B 'fail':27B 'infrastructur':20B 'input':36B 'manag':19B,25B 'neutral':29B 'queri':40B 'reach':45B 'read':49B 'special':30B 'sql':33B 'store':55B","search_c":"'1.11.01.032':80C 'affect':77C 'allow':72C 'command':65C 'deltaww':70C 'diaenergi':71C,78C 'element':60C 'improp':56C 'inject':67C,74C 'issu':76C 'neutral':57C 'special':59C 'sql':64C,66C,73C 'use':61C 'vulner':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T03:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"759f5e80-c8e1-4224-bead-956d7b33c98b","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125612","severity":null,"published_at":"2026-11-10T03:16:42+00:00","modified_at":"2026-11-10T03:16:42+00:00","first_seen_at":"2026-11-10T03:19:23+00:00","fetched_at":"2026-11-10T03:19:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}