PT-2026-2168 · Gestsup · Gestsup

Geoffrey Robert + 2 · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2026-22195

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GestSup versions up to and including 3.2.56

Description GestSup versions up to and including 3.2.56 contain a SQL injection issue in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges. The vulnerable component is the search bar. The input to the search bar, controlled by the user, is directly used in SQL queries without proper sanitization.

Recommendations Update GestSup to a version newer than 3.2.56.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-22195

Produtos afetados

Gestsup

Referências · 6

• https://twitter.com/CVEnew/status/2009670030728864245 · Publicação no Twitter
• https://t.me/CVEtracker/41866 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22195 · Nota de Segurança
• https://vulncheck.com/advisories/gestsup-sqli-in-search-bar · Nota
• https://osv.dev/vulnerability/CVE-2026-22195 · Aviso do Fabricante
• https://gestsup.fr/index.php?page=changelog · Nota