CVE-2026-54822

HighCVSS 8.5

Published: 25/06/2026(UTC)Updated: 25/10/2026(UTC)Translated: 26/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

Subscriber SQL Injection vulnerability in SALESmanago and Leadoo versions up to 3.11.2 allows unauthorized access to the database through malicious SQL query injection.

Risk Assessment

An attacker could gain access to sensitive data, potentially leading to a loss of confidentiality and financial losses for the organization.

Recommendation

It is recommended to upgrade to the latest version of the software to mitigate this vulnerability and conduct a security audit of the database.

Other vulnerabilities in SALESmanago, Leadoo

CVE-2025-68571Medium
The SALESmanago & Leadoo plugin (up to version 3.9.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.

Original NVD description (English source)

Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS