CVE-2026-9163
CriticalCVSS 9.8Summary
GIS Informatics GisLab Laboratory Management System versions from 1.4.03 before 1.5 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The flaw allows injection of malicious SQL code.
Risk Assessment
An attacker can execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion in the laboratory system database. Versions from 1.4.03 to before 1.5 are at risk.
Recommendation
Upgrade GisLab Laboratory Management System to version 1.5 or later. Until patched, restrict access to the system and monitor for unusual queries.
Other vulnerabilities in GisLab Laboratory Management System
See all- CVE-2026-9166High
A path traversal vulnerability exists in GIS Informatics GisLab Laboratory Management System due to improper limitation of a pathname to a restricted directory. The issue affects versions from 1.4.03 before 1.5.
- CVE-2026-11763Medium
An authorization bypass vulnerability in GisLab Laboratory Management System allows exploitation of user-controlled keys. This flaw enables attackers to misuse trusted identifiers, potentially gaining unauthorized access.
- CVE-2026-8297Critical
An SQL injection vulnerability has been discovered in GisLab Laboratory Management System due to improper neutralization of special elements in SQL commands. The flaw affects versions from 1.4.03 through 08072026.
Original NVD description (English source)
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5.