Vulnerability Description
GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gestsup | Gestsup | <= 3.2.56 |
Related Weaknesses (CWE)
References
- https://gestsup.fr/index.php?page=changelogRelease Notes
- https://www.vulncheck.com/advisories/gestsup-multiple-sqli-in-asset-listThird Party Advisory
FAQ
What is CVE-2026-22197?
CVE-2026-22197 is a vulnerability with a CVSS score of 8.1 (HIGH). GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated int...
How severe is CVE-2026-22197?
CVE-2026-22197 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-22197?
Check the references section above for vendor advisories and patch information. Affected products include: Gestsup Gestsup.