Search
Find a vulnerability
Search criteria
4 vulnerabilities by Tactis
CVE-2026-112198 (GCVE-0-2026-112198)
Vulnerability from nvd – Published: 2026-10-28 10:20 – Updated: 2026-10-28 10:21
VLAI
EPSS
VEX
Title
Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
Summary
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
Severity
CWE
- CWE-611 - Improper restriction of XML external entity reference
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tactis | NoviGest Desktop App |
Affected:
NoviGest Desktop App prior to version 8.0.0-300
cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:* |
Date Public
2026-10-28 10:19
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"NoviGest Desktop App version 7.4.4-292: Java RMI service and XML file import from the SAFT module"
],
"product": "NoviGest Desktop App",
"vendor": "Tactis",
"versions": [
{
"status": "affected",
"version": "NoviGest Desktop App prior to version 8.0.0-300"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pablo Jord\u00e1n Lucia"
},
{
"lang": "en",
"type": "finder",
"value": "Marina Jiali Villalta Cerezo"
}
],
"datePublic": "2026-10-28T10:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed."
}
],
"value": "XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed."
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 Data Serialization External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper restriction of XML external entity reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:21:56.415Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerability has been fixed.\u003cbr\u003e\u003cdiv\u003eFor CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas.\u003c/div\u003e"
}
],
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerability has been fixed.\nFor CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Restriction of XML External Entity Reference in Tactis\u0027 NoviGest Desktop App",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-112198",
"datePublished": "2026-10-28T10:20:06.729Z",
"dateReserved": "2026-10-19T09:39:02.723Z",
"dateUpdated": "2026-10-28T10:21:56.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112197 (GCVE-0-2026-112197)
Vulnerability from nvd – Published: 2026-10-28 10:17 – Updated: 2026-10-28 10:17
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
Summary
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tactis | NoviGest Desktop App |
Affected:
NoviGest Desktop App prior to version 8.0.0-300
cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:* |
Date Public
2026-10-28 10:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"NoviGest Desktop App version 7.4.4-292: Java RMI service and XML file import from the SAFT module"
],
"product": "NoviGest Desktop App",
"vendor": "Tactis",
"versions": [
{
"status": "affected",
"version": "NoviGest Desktop App prior to version 8.0.0-300"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pablo Jord\u00e1n Lucia"
},
{
"lang": "en",
"type": "finder",
"value": "Marina Jiali Villalta Cerezo"
}
],
"datePublic": "2026-10-28T10:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App\u0027s Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability."
}
],
"value": "Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App\u0027s Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability."
}
],
"impacts": [
{
"capecId": "CAPEC-36",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-36 Using Unpublished Interfaces or Functionality"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:17:12.401Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerabilitie have been fixed.\u003cbr\u003eFor CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files.\u003cbr\u003e"
}
],
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerabilitie have been fixed.\nFor CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Tactis\u0027 NoviGest Desktop App",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-112197",
"datePublished": "2026-10-28T10:17:12.401Z",
"dateReserved": "2026-10-19T09:39:01.039Z",
"dateUpdated": "2026-10-28T10:17:12.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112198 (GCVE-0-2026-112198)
Vulnerability from cvelistv5 – Published: 2026-10-28 10:20 – Updated: 2026-10-28 10:21
VLAI
EPSS
VEX
Title
Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
Summary
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
Severity
CWE
- CWE-611 - Improper restriction of XML external entity reference
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tactis | NoviGest Desktop App |
Affected:
NoviGest Desktop App prior to version 8.0.0-300
cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:* |
Date Public
2026-10-28 10:19
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"NoviGest Desktop App version 7.4.4-292: Java RMI service and XML file import from the SAFT module"
],
"product": "NoviGest Desktop App",
"vendor": "Tactis",
"versions": [
{
"status": "affected",
"version": "NoviGest Desktop App prior to version 8.0.0-300"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pablo Jord\u00e1n Lucia"
},
{
"lang": "en",
"type": "finder",
"value": "Marina Jiali Villalta Cerezo"
}
],
"datePublic": "2026-10-28T10:19:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed."
}
],
"value": "XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed."
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 Data Serialization External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper restriction of XML external entity reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:21:56.415Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerability has been fixed.\u003cbr\u003e\u003cdiv\u003eFor CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas.\u003c/div\u003e"
}
],
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerability has been fixed.\nFor CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Restriction of XML External Entity Reference in Tactis\u0027 NoviGest Desktop App",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-112198",
"datePublished": "2026-10-28T10:20:06.729Z",
"dateReserved": "2026-10-19T09:39:02.723Z",
"dateUpdated": "2026-10-28T10:21:56.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112197 (GCVE-0-2026-112197)
Vulnerability from cvelistv5 – Published: 2026-10-28 10:17 – Updated: 2026-10-28 10:17
VLAI
EPSS
VEX
Title
Missing Authentication for Critical Function in Tactis' NoviGest Desktop App
Summary
Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability.
Severity
CWE
- CWE-306 - Missing authentication for critical function
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tactis | NoviGest Desktop App |
Affected:
NoviGest Desktop App prior to version 8.0.0-300
cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:* |
Date Public
2026-10-28 10:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"NoviGest Desktop App version 7.4.4-292: Java RMI service and XML file import from the SAFT module"
],
"product": "NoviGest Desktop App",
"vendor": "Tactis",
"versions": [
{
"status": "affected",
"version": "NoviGest Desktop App prior to version 8.0.0-300"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tactis:novigest_desktop_app:novigest_desktop_app_prior_to_version_8.0.0-300:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pablo Jord\u00e1n Lucia"
},
{
"lang": "en",
"type": "finder",
"value": "Marina Jiali Villalta Cerezo"
}
],
"datePublic": "2026-10-28T10:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App\u0027s Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability."
}
],
"value": "Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App\u0027s Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained together to execute operating system commands on the server, compromising its confidentiality, integrity, and availability."
}
],
"impacts": [
{
"capecId": "CAPEC-36",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-36 Using Unpublished Interfaces or Functionality"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:17:12.401Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerabilitie have been fixed.\u003cbr\u003eFor CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files.\u003cbr\u003e"
}
],
"value": "Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerabilitie have been fixed.\nFor CVE-2026-112197, remote methods that access data require a JWT session token validated on the server. Interfaces that exposed credentials and allowed arbitrary SQL execution have been removed, and the privileges of the PostgreSQL account have been reduced to prevent program execution and access to server files."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Missing Authentication for Critical Function in Tactis\u0027 NoviGest Desktop App",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-112197",
"datePublished": "2026-10-28T10:17:12.401Z",
"dateReserved": "2026-10-19T09:39:01.039Z",
"dateUpdated": "2026-10-28T10:17:12.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}