CVE-2026-14571

{
  "etk_id": "ETK-2026-2850",
  "cve_id": "CVE-2026-14571",
  "display_id": "CVE-2026-14571",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-111845",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Blind SQL injection in Futurum User Authentication Module",
  "summary": "Futurum Software User Authentication Module is affected by blind SQL injection in database queries used by its private area. An unauthenticated attacker may bypass protections and execute database queries, potentially exposing database structure and sensitive customer information, by sending manipulated HTTP requests.",
  "mitigation": "Update the Futurum Software User Authentication Module to the fixed release issued in May 2026. Until the update is deployed, restrict access to the private area to trusted networks and users.",
  "vendor": "Futurum Software",
  "product": "Futurum Software User Authentication Module",
  "affected": [
    {
      "affected_notes": [
        ">= 0, < May 2026"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [
        "May 2026"
      ],
      "package_name": "Futurum Software User Authentication Module",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.753888366666667,
  "t0_at": "2026-10-28T09:15:03.663000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T09:15:03.663000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T09:15:03.663000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-14571"
    }
  }
}