Futurum Software 管理軟體曝出 CVE-2026-14571 SQL 注入漏洞
CVE-2026-14571 - SQL injection (SQLi) in the user authentication module of Futurum Software
Futurum Software 的管理軟體發現了 CVE-2026-14571，這是一個在使用者認證模組中的 Blind SQL 注入漏洞。
- 漏洞型別：Blind SQL Injection，允許未授權使用者執行任意查詢。
A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).
Impact
Affected Products
The following products are affected by CVE-2026-14571
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | CRITICAL | 0cbda920-cd7f-484a-8e76-bf7f4b7f4516 |
Address SQL injection by validating and sanitizing inputs and correcting WAF rules.
- Validate and sanitize all user inputs.
- Ensure WAF rules correctly block malicious queries.
- Update management software to the latest version.
- Restrict database access to authorized personnel.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-14571 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.