Profleet
Monthly
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.