CVE-2026-22197

HIGH

8.1

Description

GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published1/9/2026

Last Modified1/14/2026

Sourcenvd

Honeypot Sightings0

Affected Products

gestsup:gestsup

Weaknesses (CWE)

CWE-89

References

https://gestsup.fr/index.php?page=changelog(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/gestsup-multiple-sqli-in-asset-list(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.