Blind SQL Injection Vulnerability in Futurum Software Management Software
CVE-2026-14571

9.1CRITICAL

Key Information:

Vendor

Futurum Software

Status
Futurum Software User Authentication Module
Vendor
CVE Published:
28 October 2026

What is CVE-2026-14571?

A Blind SQL Injection vulnerability exists in Futurum Software’s management software due to insufficient validation and sanitization of user input within database queries. Inadequate web application firewall (WAF) configuration further exacerbates this issue, allowing attackers to bypass security measures through crafted HTTP requests. Successful exploitation can enable an unauthorized user to run arbitrary database queries, revealing the database structure and granting access to sensitive information, including personally identifiable information (PII) of customers.

Affected Version(s)

Futurum Software User Authentication Module 0

References

https://www.incibe.es/en/incibe-cert/notices/aviso/sql-in...

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Diego González Aguín (Celerx)
.