Threat database

CVE-2026-12260 is a critical SQL injection vulnerability in the NetBoard CRM Demo Platform. It affects the 'user-name' POST parameter at the '/module/auth/recovery.php' endpoint. The flaw allows blind SQL injection attacks using Boolean, error, time-based, and UNION techniques. Exploitation can lead to unauthorized data extraction, including backend version and type, data alteration, or further system compromise.