PT-2026-2169 · Gestsup · Gestsup

Geoffrey Robert + 2 · Published 2026-01-09 · Updated 2026-01-09 · CVE-2026-22196

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GestSup versions up to and including 3.2.56

Description GestSup versions up to and including 3.2.56 contain a SQL injection issue in the ticket creation functionality. User-controlled input during ticket creation is used in SQL queries without proper sanitization, potentially allowing an authenticated attacker to manipulate database queries. Successful exploitation could lead to unauthorized access or modification of database contents, depending on database privileges.

Recommendations Update GestSup to a version newer than 3.2.56.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-22196

Affected Products

Gestsup

References · 6

• https://osv.dev/vulnerability/CVE-2026-22196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22196 · Security Note
• https://twitter.com/CVEnew/status/2009670027520131442 · Twitter Post
• https://gestsup.fr/index.php?page=changelog · Note
• https://vulncheck.com/advisories/gestsup-sqli-in-ticket-creation · Note
• https://t.me/CVEtracker/41867 · Telegram Post