SQL Injection Vulnerability in GestSup Ticket Creation by GestSup
CVE-2026-22196

7.7HIGH

Key Information:

Vendor

Gestsup

Status
Gestsup
Vendor
CVE Published:
9 January 2026

What is CVE-2026-22196?

GestSup versions before 3.2.60 are susceptible to a SQL injection vulnerability within the ticket creation feature. This issue arises from inadequate neutralization of user-controlled input incorporated into SQL queries. An authenticated attacker can manipulate these database queries, potentially leading to unauthorized access or alteration of database contents based on existing database privileges. It is vital for users to promptly update to the latest version to mitigate potential risks.

Affected Version(s)

GestSup 0 < 3.2.60

References

https://gestsup.fr/index.php?page=changelog
release-notes
https://www.vulncheck.com/advisories/gestsup-sqli-in-tick...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Geoffrey Robert and Valentin Holubec of Akailabs
VulnCheck
.