High severity · published Jan 9, 2026
CVE-2026-22196
GestSup < 3.2.60 SQL Injection in Ticket Creation
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can result in unauthorized access to or modification of database contents depending on database privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GestSup · GestSup
before 3.2.60 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22196
Release Notes
https://gestsup.fr/index.php?page=changelog
Third Party Advisory
https://www.vulncheck.com/advisories/gestsup-sqli-in-ticket-creation
More from GestSup
9.8
CVE-2021-31646
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote)
8.8
CVE-2026-22194
GestSup <= 3.2.60 CSRF Allows Privileged Actions
8.1
CVE-2026-100389
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
8.1
CVE-2026-22197
GestSup < 3.2.60 Multiple SQL Injections in Asset List
8.1
CVE-2026-22195
GestSup < 3.2.60 SQL Injection in Search Bar