CVE-2026-12260

{
  "etk_id": "ETK-2026-958",
  "cve_id": "CVE-2026-12260",
  "display_id": "CVE-2026-12260",
  "ghsa_id": "GHSA-cjh7-98xw-p5c3",
  "euvd_id": "EUVD-2026-94803",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in NetBoard CRM Demo Platform recovery",
  "summary": "NetBoard CRM Demo Platform is affected by an SQL injection flaw in the user-name POST field handled by the recovery endpoint. An attacker able to submit requests to that endpoint may read sensitive information, modify data, or gain further access to the CRM environment.",
  "mitigation": "Update NetBoard CRM Demo Platform to fixed release 08/10/2026. Until updated, restrict access to the account-recovery endpoint to trusted networks or users where feasible.",
  "vendor": "NetBoard CRM",
  "product": "NetBoard CRM Demo Platform",
  "affected": [
    {
      "affected_notes": [
        ">= 0, < 08/10/2026"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [
        "08/10/2026"
      ],
      "package_name": "NetBoard CRM Demo Platform",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
  "epss_score": 0.0023,
  "epss_percentile": 0.1277,
  "epss_asof": "2026-10-21",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.551583816666664,
  "t0_at": "2026-10-08T08:04:59.875000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T08:04:59.875000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T08:04:59.875000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12260"
    }
  }
}