CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

CVE-2026-54597

ITFlow , an IT documentation and ticketing system for managed service providers, is vulnerable to an authenticated time-based blind SQL injection via the expires GET parameter in the share_generate_link handler of agent/ajax.php. The root cause is that sanitizeInput applies string-context escapin...

CVE-2026-54597: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...