Is CVE-2026-50769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50769 being exploited in the wild.

How severe is CVE-2026-50769?

Critical severity, with a CVSS score of 9.8, published 17 August 2026.

Which products and versions are affected?

Brainformatik CRM+ 2025.6 and earlier.

Is there a fix for CVE-2026-50769?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-50769 attacked?

It is attacked over the network.

Am I affected by CVE-2026-50769?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50769: Brainformatik CRM+ SQL injection in appointment conflict check

CVE-2026-50769 · Severity: critical · CVSS 9.8 · Published 2026-08-17

CRM+ is a customer relationship management platform used by businesses to manage sales, marketing, customer support, and billing processes. The application contains a time-based SQL injection vulnerability in the appointment scheduling feature that allows an authenticated attacker to extract or manipulate database contents, potentially exposing sensitive customer and business data or disrupting operations.

Quick answers

Is CVE-2026-50769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50769 being exploited in the wild.
How severe is CVE-2026-50769?: Critical severity, with a CVSS score of 9.8, published 17 August 2026.
Which products and versions are affected?: Brainformatik CRM+ 2025.6 and earlier.
Is there a fix for CVE-2026-50769?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50769 attacked?: It is attacked over the network.
Am I affected by CVE-2026-50769?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-based blind SQL injection in the CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true). The userId parameter is not properly sanitized before being included in a SQL query, allowing an attacker to inject arbitrary SQL code. The attack requires authentication (login to the application) and network access to the CRM+ instance. An attacker can use time-based techniques or automated tools like SQLMap to extract data from the underlying MySQL database. Versions 2025.6 and earlier are affected; patch availability from Brainformatik has not been confirmed in the advisory.

Affected products

Brainformatik CRM+ 2025.6 and earlier

Timeline

2026-08-17: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.