SQL Injection Vulnerability in NetBoard CRM by INCE

CVE-2026-12260

What is CVE-2026-12260?

The NetBoard CRM demo platform is susceptible to an SQL injection vulnerability, specifically through the 'user-name' POST parameter in the '/module/auth/recovery.php' endpoint. This vulnerability allows attackers to perform blind SQL injection attacks, leveraging Boolean, error, time-based, and UNION techniques. Successful exploitation can lead to the unauthorized extraction of sensitive information, such as the backend version and type, the alteration of existing data, or further compromises within the CRM environment.

References