---
id: "CVE-2026-125612"
page: "https://infrastack.ai/live/CVE-2026-125612"
kind: "vulnerability"
aliases: ["CVE-2026-125612"]
title: "Deltaww DIAEnergie: SQL injection flaw before version 1.11.01.032"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["deltaww", "diaenergie", "energy-management", "infrastructure"]
not_affected_if: ["patched-version"]
published_at: "2026-11-10T03:16:42+00:00"
first_seen_at: "2026-11-10T03:19:23+00:00"
updated_at: "2026-11-10T03:19:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125612", "first_seen_at": "2026-11-10T03:19:23+00:00"}]
exploit_sources: []
---

# Deltaww DIAEnergie: SQL injection flaw before version 1.11.01.032

Link for people: https://infrastack.ai/live/CVE-2026-125612 (this .md is for agents)

Deltaww DIAEnergie, an energy management application, fails to neutralize special characters in SQL commands, so input can alter database queries. An attacker who can reach the application can read or change the data it stores.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DIAEnergie version in the application's about or version screen, and compare it with `1.11.01.032`

## Fix

- DIAEnergie: move to `1.11.01.032` or later

## Timeline

- 2026-11-10T03:19:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125612

## From the sources

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Deltaww DIAEnergie allows SQL Injection.

This issue affects DIAEnergie: before 1.11.01.032.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_