Live › vulnerability › CVE-2026-14571
Go to dashboardFuturum Software's management software does not validate user input sent to its private-area database queries, and a WAF misconfiguration lets crafted HTTP requests bypass protection. An unauthenticated attacker can run arbitrary database queries, map the database structure and read sensitive customer data including PII.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 10:32 UTC. All times on this page are UTC.
Anyone running Futurum Software's management software with its web private area (User Authentication Module) reachable from the internet. Exposure comes from unvalidated input reaching database queries plus a WAF misconfiguration that lets crafted requests through. Teams not using Futurum Software can skip it; versions are not published yet.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).
This page as .md · .json · in your agent: get_signal("CVE-2026-14571")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.