Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection.

This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
Published: 2026-07-17
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an SQL injection flaw in GisLab Laboratory Management System that allows an attacker to inject arbitrary SQL into backend queries. The flaw enables unauthorized read or modification of the database.

Affected Systems

Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. produces the GisLab Laboratory Management System. Versions affected are 1.4.03 through 08072026.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% suggests a low but nonzero exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The CVE description does not specify the attack vector or authentication requirements, so those details remain unknown.

Generated by OpenCVE AI on August 1, 2026 at 08:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest patch or update to GisLab version 08072026 or later if made available by Gis Informatics.
  • If no patch is available, restrict external access to the web application or temporarily disable the affected module while monitoring for suspicious activity.
  • Reconfigure database access so that the application uses the least privilege principle; consider switching to prepared statements or parameterized queries to mitigate injection errors.

Generated by OpenCVE AI on August 1, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Gis Informatics
Gis Informatics gislab Laboratory Management System
Vendors & Products Gis Informatics
Gis Informatics gislab Laboratory Management System

Fri, 17 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
Title SQLi in GIS Informatics' GisLab Laboratory Management System
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Gis Informatics Gislab Laboratory Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-07-17T16:38:29.611Z

Reserved: 2026-05-11T10:29:13.254Z

Link: CVE-2026-8297

cve-icon Vulnrichment

Updated: 2026-07-17T16:38:21.534Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T08:30:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')