TSG Profleet CVE-2026-111472

Exploitation requires that TSG Profleet be deployed with its PHP web interface reachable by the attacker and the '/cgi-bin/index.php' endpoint accepting the 'Identificación' GET parameter - which appears to be the default request path, not an optional feature. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, no user interaction, and no special configuration are needed; the primary limiting factor is network exposure of the Profleet application and the product's narrow deployment footprint, so risk concentrates in organizations that actually run internet-facing Profleet instances.

All exploitability signals point to a genuinely high-priority flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, and the vulnerable-system impacts are all High (VC:H/VI:H/VA:H) - consistent with CWE-89 SQL injection that permits reading, creating, updating and deleting database records. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the 9.3 rating reflects intrinsic severity, not observed attacks. The tempering factor is reach: TSG Profleet is an obscure, industry-specific fleet product with INCIBE as the sole reporting source, so this is likely a targeted rather than internet-wide concern. Net: technically critical and trivially exploitable where the product is exposed, but real-world urgency depends on whether your organization actually runs Profleet and exposes /cgi-bin/index.php.

A remote, unauthenticated attacker sends a single crafted HTTP GET request to /cgi-bin/index.php with a malicious value in the 'Identificación' parameter, injecting SQL that the backend executes directly. Because no authentication or user interaction is needed, the attacker can dump sensitive records and then modify or delete database contents. No public exploit code was identified in the provided data, but the injection point is simple enough to weaponize quickly.