CVE-2026-12260: Netboard CRM Demo Platform

Critical severity, CVSS 10.0. EPSS: 0.2% chance of exploitation in the next 30 days.

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.

Affected products

• Netboard CRM Netboard CRM Demo Platform

Published 2026-10-08. Last modified 2026-10-08.