PT-2026-2169 · Gestsup · Gestsup

Geoffrey Robert + 2 · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2026-22196

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GestSup versions up to and including 3.2.56

Description GestSup versions up to and including 3.2.56 contain a SQL injection issue in the ticket creation functionality. User-controlled input during ticket creation is used in SQL queries without proper sanitization, potentially allowing an authenticated attacker to manipulate database queries. Successful exploitation could lead to unauthorized access or modification of database contents, depending on database privileges.

Recommendations Update GestSup to a version newer than 3.2.56.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-22196

Produtos afetados

Gestsup

Referências · 6

• https://osv.dev/vulnerability/CVE-2026-22196 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22196 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009670027520131442 · Publicação no Twitter
• https://gestsup.fr/index.php?page=changelog · Nota
• https://vulncheck.com/advisories/gestsup-sqli-in-ticket-creation · Nota
• https://t.me/CVEtracker/41867 · Publicação no Telegram