{"id":"CVE-2026-14571","kind":"vulnerability","aliases":["CVE-2026-14571"],"related":[],"title":"Futurum Software management software: blind SQL injection exposes customer PII","description":"A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).","summary":"Futurum Software's management software does not validate user input sent to its private-area database queries, and a WAF misconfiguration lets crafted HTTP requests bypass protection. An unauthenticated attacker can run arbitrary database queries, map the database structure and read sensitive customer data including PII.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["futurum-software","management-software","sql-injection","unauthenticated","vendor","waf-bypass"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T10:17:08+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:20+00:00","updated_at":"2026-10-28T10:36:00+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-28T10:34:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Futurum Software management software: blind SQL injection exposes customer PII","impact":"high","summary":"Futurum Software's management software does not validate user input sent to its private-area database queries, and a WAF misconfiguration lets crafted HTTP requests bypass protection. An unauthenticated attacker can run arbitrary database queries, map the database structure and read sensitive customer data including PII.","category":"vendor","nicknames":[],"who_cares":["futurum-software","management-software","sql-injection"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads full database including customer PII","analyst_note":"Identify the affected Futurum Software product name, versions and vendor patch or advisory; the NVD entry gives no version or fix details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000522,"input_tokens":3407,"output_tokens":362,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected Futurum Software product name, versions and vendor patch or advisory; the NVD entry gives no version or fix details.","search":"'-14571':13A,16A '-2026':12A,15A 'access':157C 'adequ':94C 'allow':121C,140C 'arbitrari':64B,146C 'area':46B,108C 'attack':61B,143C 'blind':5A,79C 'bypass':30B,57B,127C 'caus':89C 'complet':153C 'configur':118C 'could':139C 'craft':54B 'custom':9A,74B,160C 'cve':11A,14A 'data':75B 'databas':47B,65B,69B,110C,150C 'execut':145C 'exploit':135C 'expos':8A 'extract':151C 'futurum':1A,18B,31B,84C 'futurum-softwar':17B 'gain':156C 'http':55B,132C 'identifi':164C 'includ':76B,162C 'incorrect':116C 'inform':161C,165C 'inject':7A,25B,81C 'input':40B,102C 'lack':92C 'let':53B 'manag':3A,21B,34B,87C 'management-softwar':20B 'manipul':131C 'map':67B 'mechan':124C 'misconfigur':52B 'person':163C 'pii':10A,77B,166C 'privat':45B,107C 'private-area':44B 'protect':58B,123C 'provid':101C 'queri':48B,66B,104C,147C 'read':72B 'request':56B,133C 'run':63B 'sanitis':97C 'send':130C 'sensit':73B,159C 'sent':41B 'softwar':2A,4A,19B,22B,32B,35B,85C,88C 'sole':128C 'sql':6A,24B,80C 'sql-inject':23B 'structur':70B,154C 'success':134C 'unauthent':26B,60B,142C 'user':39B,100C 'user-provid':99C 'valid':38B,95C 'vendor':27B 'vulner':82C,138C 'waf':29B,51B,117C 'waf-bypass':28B 'weak':120C 'well':112C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Futurum Software's management software with its web private area (User Authentication Module) reachable from the internet. Exposure comes from unvalidated input reaching database queries plus a WAF misconfiguration that lets crafted requests through. Teams not using Futurum Software can skip it; versions are not published yet.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14571","severity":null,"published_at":"2026-10-28T10:17:08+00:00","modified_at":"2026-10-28T10:17:08+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-14571:948","url":null,"severity":null,"published_at":"2026-10-28T10:36:00+00:00","modified_at":"2026-10-28T10:36:00+00:00","first_seen_at":"2026-10-28T10:36:00+00:00","fetched_at":"2026-10-28T10:36:00+00:00","note":"CNA is INCIBE (cve.org); NVD and cve.org pages are empty and no INCIBE-CERT notice or vendor advisory found yet (published 2026-10-28). Secondary vuln.today: User Authentication Module, CVSS 4.0 9.1, unauthenticated, no public exploit known, versions not enumerated. Affected versions, fix and check command unknown; re-check the INCIBE-CERT security-advisories page for a Futurum notice. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}