SQL Injection Vulnerability in GestSup by GestSup
CVE-2026-22195

7.7HIGH

Key Information:

Vendor

Gestsup

Status
Gestsup
Vendor
CVE Published:
9 January 2026

What is CVE-2026-22195?

GestSup versions prior to 3.2.60 showcase a SQL injection vulnerability located in the search bar functionality. This flaw allows user-controlled input to be inadequately sanitized before being included in SQL queries. As a result, authenticated attackers can exploit this vulnerability to manipulate database queries, potentially gaining unauthorized access or making unapproved modifications to the database's contents based on their privileges.

Affected Version(s)

GestSup 0 < 3.2.60

References

https://gestsup.fr/index.php?page=changelog
release-notes
https://www.vulncheck.com/advisories/gestsup-sqli-in-sear...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert and Valentin Holubec of Akailabs
VulnCheck
.