SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint.
CVSS 4.0CRITICAL 10.0·Network·No auth·No interaction·EPSS 0.00228·Published 2026-10-08·Fixed in 08/10/2026CWE-89