An SQL injection flaw exists in TSG Profleet's /cgi-bin/index.php endpoint, triggered by a GET request that uses the ‘Identificación’ parameter. The vulnerability allows an attacker to read, write, and delete database records, compromising confidentiality and integrity of stored data. This weakness is identified as CWE‑89: SQL Injection. No evidence of remote code execution is present, but the ability to alter data can enable further malicious activities.

The affected product is TSG Profleet. No specific version information is disclosed, so all installations of this product may be vulnerable.

The CVSS score of 9.3 marks this as a high severity vulnerability. The EPSS score of < 1% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so its exploitation risk is not yet confirmed, but the combination of high severity and low EPSS makes it a concern that should be monitored. The flaw can be exploited remotely by sending a crafted GET request to the identified endpoint, requiring no special privileges or internal access.