CVE-2026-8297

Name of the Vulnerable Software and Affected Versions GisLab Laboratory Management System versions 1.4.03 through 08072026

Description An unauthenticated SQL injection exists in the web application backend due to improper neutralization of special elements used in SQL commands. This occurs when unsafe user-supplied input reaches database queries because of a failure in input validation or parameterization. A remote attacker can send crafted requests to vulnerable endpoints and parameters to achieve full database compromise, including data exfiltration, modification, and authentication bypass. Depending on the server configuration and database features, this could potentially lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.