SQL injection in TSG Profleet
Posted date 16/10/2026
Identificador
INCIBE-2026-754
Importance
5 - Critical
Affected Resources
TSG Profleet version 12.004.01.
Description
INCIBE has coordinated the disclosure of a critical severity vulnerability affecting Profleet, a product from TSG, a provider of refuelling solutions for commercial and industrial fleets. The vulnerability was discovered by Rubén Barrios.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-111472: CVSS v4.0: 9.3 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. | CWE-89
Solution
No solution has been reported as yet.
Detail
CVE-2026-111472: an SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-111472 | Crítica | No | PROFLEET |
References list
Etiquetas
