CVE-2026-22196
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-09

Last updated on: 2026-01-09

Assigner: VulnCheck

Description
GestSup versions up to and including 3.2.56 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-09
Last Modified
2026-01-09
Generated
2026-06-16
AI Q&A
2026-01-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-22196
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gestsup gestsup to 3.2.56 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-22196 is a SQL injection vulnerability in GestSup versions up to and including 3.2.56. It occurs in the ticket creation functionality where user input is directly included in SQL queries without proper neutralization. This allows an authenticated attacker to manipulate database queries, potentially leading to unauthorized access or modification of the database depending on the privileges of the database user. [2]

Impact Analysis

This vulnerability can allow an authenticated attacker to manipulate SQL queries in the GestSup application, which may result in unauthorized access to or modification of the database contents. The impact depends on the database privileges but can include data disclosure, data corruption, or disruption of service. [2]

Mitigation Strategies

To mitigate this SQL injection vulnerability in GestSup versions up to 3.2.56, you should update GestSup to a version later than 3.2.56 where the vulnerability is fixed. The changelog indicates that security improvements and fixes addressing multiple CVEs, including SQL injection issues, have been implemented in versions 3.2.45 and later. Additionally, ensure that only authenticated users with appropriate privileges can create tickets, and consider applying strict input validation and sanitization on ticket creation inputs as a temporary measure until the update is applied. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart