CVE-2026-2247

CVE-2026-2247 describes a high-severity SQL injection vulnerability (CWE-89) in the Clicldeu SaaS platform, specifically affecting the report generation function within the mobile application's 'Day-to-day' section. An authenticated remote attacker can exploit this flaw by manipulating the URL when downloading a student's report card, leveraging a non-expiring session token and the 'id_alu' parameter to execute boolean-based blind or time-based blind SQLi. This could lead to unauthorized access to confidential database information. The vulnerability carries a CVSSv4 score of 8.3 (High) due to its network-based attack vector, low attack complexity, and high impact on confidentiality. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.