Threat Investigation
Request a demo

CVE-2026-12260

Critical

Description

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

SeverityCritical
CVSS10.0
Exploit probability—
ProductNetBoard CRM Demo Platform
PublishedOct 8, 2026
First seenOct 8, 2026
Weakness typeCWE-89SQL injection

How to fix

Update
  • NetBoard CRM NetBoard CRM Demo Platform08/10/2026 or later

Affected products

ProductAffected versionsFixed in
NetBoard CRM NetBoard CRM Demo Platformv < 08/10/202608/10/2026

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.