CVE-2026-12260— SQL injection in the NetBoard CRM demo platform
Quick assessment
Affected
NetBoard CRM NetBoard CRM Demo Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NetBoard CRM 演示平台存在 SQL 注入漏洞；具体而言，易受攻击的组件是位于 端点的 POST 参数 。该参数易受基于布尔值、报错、时间延迟以及 UNION 注入技术的盲注攻击。攻击者利用此漏洞可提取敏感信息（例如后端系统所使用的版本和类型），篡改数据，或进一步破坏 CRM 环境的安全。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12260
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL injection in the NetBoard CRM demo platform
Source: CVE Program / CVE List V5
Vulnerability Description
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| NetBoard CRM | NetBoard CRM Demo Platform | 0 ~ 08/10/2026 | - |
|
II. Public POCs for CVE-2026-12260
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12260
请登录查看更多情报信息。
Other References for CVE-2026-12260 (1)
IV. Related Vulnerabilities
Same weakness: CWE-89
-
CVE-2026-5048
Brocade SANnav 3.0.0a前版本存在SQL注入漏洞 -
CVE-2026-76270
Structured Query Language (SQL) Injection in the SPL2 Module -
CVE-2026-95605
WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vu -
CVE-2026-76452
Cisco Smart Software Manager On-Prem SQL Injection Vulnerabi -
CVE-2026-62251
Homer: Authenticated SQL Injection via Unvalidated rawquery
V. Comments for CVE-2026-12260
No comments yet