Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-90983 (GCVE-0-2026-90983)

Vulnerability from cvelistv5 – Published: 2026-10-09 15:22 – Updated: 2026-10-09 18:09

Title

OTP Code Exposure in Hayat Hospital's Hayat Mobile

Summary

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 18:08 UTC

CWE

CWE-603 - Use of Client-Side authentication

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Hayat Health Facilities Inc. (Hayat Hospital)	Hayat Mobile	Affected: 3.3.0 , < 3.4.0 (semver)

Date Public

2026-10-09 14:34

Credits

Serdar ÇATAL

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T18:08:52.836442Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T18:09:02.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hayat Mobile",
          "vendor": "Hayat Health Facilities Inc. (Hayat Hospital)",
          "versions": [
            {
              "lessThan": "3.4.0",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Serdar \u00c7ATAL"
        }
      ],
      "datePublic": "2026-10-09T14:34:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.\u003cp\u003eThis issue affects Hayat Mobile: from 3.3.0 before 3.4.0.\u003c/p\u003e"
            }
          ],
          "value": "Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.\n\nThis issue affects Hayat Mobile: from 3.3.0 before 3.4.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-603",
              "description": "CWE-603 Use of Client-Side authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T15:22:11.424Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1289"
        }
      ],
      "source": {
        "advisory": "TR-26-1289",
        "defect": [
          "TR-26-1289"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "OTP Code Exposure in Hayat Hospital\u0027s Hayat Mobile",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-90983",
    "datePublished": "2026-10-09T15:22:11.424Z",
    "dateReserved": "2026-09-14T13:48:34.622Z",
    "dateUpdated": "2026-10-09T18:09:02.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92085 (GCVE-0-2026-92085)

Vulnerability from cvelistv5 – Published: 2026-10-09 13:26 – Updated: 2026-10-09 16:46

Title

Stored XSS in TMT Machine's Talassoft Industrial Management Software

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 16:15 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
TMT Machinery Industry and Trade Co. Ltd.	Talassoft Industrial Management Software	Affected: 0 , < V16.0.1 (semver)

Date Public

2026-10-09 13:23

Credits

Samet Yılmaz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92085",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T16:15:26.864695Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T16:46:34.330Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Talassoft Industrial Management Software",
          "vendor": "TMT Machinery Industry and Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "V16.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Samet Y\u0131lmaz"
        }
      ],
      "datePublic": "2026-10-09T13:23:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS.\u003cp\u003eThis issue affects Talassoft Industrial Management Software: before V16.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS.\n\nThis issue affects Talassoft Industrial Management Software: before V16.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T13:26:29.259Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1288"
        }
      ],
      "source": {
        "advisory": "TR-26-1288",
        "defect": [
          "TR-26-1288"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Stored XSS in TMT Machine\u0027s Talassoft Industrial Management Software",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-92085",
    "datePublished": "2026-10-09T13:26:29.259Z",
    "dateReserved": "2026-09-15T13:46:02.606Z",
    "dateUpdated": "2026-10-09T16:46:34.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86405 (GCVE-0-2026-86405)

Vulnerability from cvelistv5 – Published: 2026-10-09 12:52 – Updated: 2026-10-09 12:52

Title

Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop

Summary

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-347 - Improper verification of cryptographic signature

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Sipay Electronic Money and Payment Services Inc.	PrestaShop Virtual POS Module	Affected: 26.8.1 , < 26.9.1 (semver)

Date Public

2026-10-09 12:47

Credits

Yasin SUER

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PrestaShop Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:52:43.902Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1287"
        }
      ],
      "source": {
        "advisory": "TR-26-1287",
        "defect": [
          "TR-26-1287"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s SanalPos PrestaShop",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-86405",
    "datePublished": "2026-10-09T12:52:43.902Z",
    "dateReserved": "2026-09-07T11:25:25.549Z",
    "dateUpdated": "2026-10-09T12:52:43.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85531 (GCVE-0-2026-85531)

Vulnerability from cvelistv5 – Published: 2026-10-09 12:28 – Updated: 2026-10-09 12:28

Title

Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x

Summary

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-347 - Improper verification of cryptographic signature

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Sipay Electronic Money and Payment Services Inc.	OpenCart Virtual POS Module	Affected: 26.8.2 , < 26.9.1 (semver)

Date Public

2026-10-09 12:01

Credits

Yasin SUER

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenCart Virtual POS Module",
          "vendor": "Sipay Electronic Money and Payment Services Inc.",
          "versions": [
            {
              "lessThan": "26.9.1",
              "status": "affected",
              "version": "26.8.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yasin SUER"
        }
      ],
      "datePublic": "2026-10-09T12:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\u003cp\u003eThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-475",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-475 Signature Spoofing by Improper Validation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347 Improper verification of cryptographic signature",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T12:28:54.969Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1286"
        }
      ],
      "source": {
        "advisory": "TR-26-1286",
        "defect": [
          "TR-26-1286"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Payment Validation Bypass in Sipay Electronic Money\u0027s OpenCart 3.x",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85531",
    "datePublished": "2026-10-09T12:28:54.969Z",
    "dateReserved": "2026-09-04T08:44:49.198Z",
    "dateUpdated": "2026-10-09T12:28:54.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12859 (GCVE-0-2026-12859)

Vulnerability from cvelistv5 – Published: 2026-10-08 14:33 – Updated: 2026-10-08 19:14

Title

IDOR in Caz Informatics' Advancity ALMS Cloud

Summary

Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 19:14 UTC

CWE

CWE-862 - Missing Authorization

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Caz Informatics Services Trade Inc.	Advancity ALMS Cloud	Affected: 0 , ≤ 2026-10-08 (date)

Date Public

2026-10-08 14:29

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:14:33.586556Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:14:43.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Advancity ALMS Cloud",
          "vendor": "Caz Informatics Services Trade Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2026-10-08",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "datePublic": "2026-10-08T14:29:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects Advancity ALMS Cloud: through 2026-10-08.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted early about this disclosure but did not respond in any way.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Advancity ALMS Cloud: through 2026-10-08.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T14:33:42.457Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1276"
        }
      ],
      "source": {
        "advisory": "TR-26-1276",
        "defect": [
          "TR-26-1276"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "IDOR in Caz Informatics\u0027 Advancity ALMS Cloud",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-12859",
    "datePublished": "2026-10-08T14:33:42.457Z",
    "dateReserved": "2026-06-22T07:03:56.120Z",
    "dateUpdated": "2026-10-08T19:14:43.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-89290 (GCVE-0-2026-89290)

Vulnerability from cvelistv5 – Published: 2026-10-08 13:45 – Updated: 2026-10-08 13:57

Title

HTML Injection in İzometri Informatics' eimzamip

Summary

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.

Severity

3.5 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 13:56 UTC

CWE

CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
İzometri IT Services Domestic and Foreign Trade Co. Ltd.	eimzamip	Affected: v1.6.4 , < v1.6.7 (custom)

Date Public

2026-10-08 13:43

Credits

Koray Danışma Tahsin Ünlütürk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:56:52.710818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:01.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.7",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.7.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:45:43.188Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "HTML Injection in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-89290",
    "datePublished": "2026-10-08T13:45:43.188Z",
    "dateReserved": "2026-09-11T12:22:23.701Z",
    "dateUpdated": "2026-10-08T13:57:01.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91844 (GCVE-0-2026-91844)

Vulnerability from cvelistv5 – Published: 2026-10-08 13:42 – Updated: 2026-10-08 13:57

Title

Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip

Summary

Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 13:57 UTC

CWE

CWE-434 - Unrestricted upload of file with dangerous type

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
İzometri IT Services Domestic and Foreign Trade Co. Ltd.	eimzamip	Affected: v1.6.4 , < v1.6.6 (custom)

Date Public

2026-10-08 13:36

Credits

Koray Danışma Tahsin Ünlütürk

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:57:15.354769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:24.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.6",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.6.\u003c/p\u003e"
            }
          ],
          "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17 Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted upload of file with dangerous type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:42:27.448Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution via Unrestricted File Upload in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-91844",
    "datePublished": "2026-10-08T13:42:27.448Z",
    "dateReserved": "2026-09-15T08:35:49.507Z",
    "dateUpdated": "2026-10-08T13:57:24.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19218 (GCVE-0-2026-19218)

Vulnerability from cvelistv5 – Published: 2026-10-08 12:03 – Updated: 2026-10-08 14:12

Title

Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta

Summary

Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 14:12 UTC

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
AKIN Software Computer Import-Export Industry and Trade Co. Ltd.	MyRezzta	Affected: 2.06.03 , < 2.07.01 (semver)

Date Public

2026-10-08 12:00

Credits

Berat ARSLAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19218",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:12:19.136142Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:12:26.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MyRezzta",
          "vendor": "AKIN Software Computer Import-Export Industry and Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "2.07.01",
              "status": "affected",
              "version": "2.06.03",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Berat ARSLAN"
        }
      ],
      "datePublic": "2026-10-08T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation.\u003cp\u003eThis issue affects MyRezzta: from 2.06.03 before 2.07.01.\u003c/p\u003e"
            }
          ],
          "value": "Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation.\n\nThis issue affects MyRezzta: from 2.06.03 before 2.07.01."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-50",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-50 Password Recovery Exploitation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T12:03:29.423Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1274"
        }
      ],
      "source": {
        "advisory": "TR-26-1274",
        "defect": [
          "TR-26-1274"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Password Reset Code Brute Force Leading to Account Takeover in AKIN Software\u0027s MyRezzta",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-19218",
    "datePublished": "2026-10-08T12:03:29.423Z",
    "dateReserved": "2026-08-07T08:50:33.629Z",
    "dateUpdated": "2026-10-08T14:12:26.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92555 (GCVE-0-2026-92555)

Vulnerability from cvelistv5 – Published: 2026-10-08 11:49 – Updated: 2026-10-08 14:12

Title

Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

Summary

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 14:12 UTC

CWE

CWE-201 - Insertion of sensitive information into sent data

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
AKIN Software Computer Import-Export Industry and Trade Co. Ltd.	AKINSOFT WOLVOX Control Panel	Affected: 26.02.25 , < 26.02.26 (semver)

Date Public

2026-10-08 11:46

Credits

Muhammet Enes Aydın

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92555",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:12:38.665829Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:12:48.906Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AKINSOFT WOLVOX Control Panel",
          "vendor": "AKIN Software Computer Import-Export Industry and Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "26.02.26",
              "status": "affected",
              "version": "26.02.25",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Muhammet Enes Ayd\u0131n"
        }
      ],
      "datePublic": "2026-10-08T11:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources.\u003cp\u003eThis issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources.\n\nThis issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-545",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-545 Pull Data from System Resources"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Insertion of sensitive information into sent data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:51:28.905Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1273"
        }
      ],
      "source": {
        "advisory": "TR-26-1273",
        "defect": [
          "TR-26-1273"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Database Credentials Disclosure in AKIN Software\u0027s AKINSOFT WOLVOX Control Panel",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-92555",
    "datePublished": "2026-10-08T11:49:47.286Z",
    "dateReserved": "2026-09-16T13:14:02.770Z",
    "dateUpdated": "2026-10-08T14:12:48.906Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-19083 (GCVE-0-2026-19083)

Vulnerability from cvelistv5 – Published: 2026-10-08 11:32 – Updated: 2026-10-08 14:20

Title

IDOR in AKIN Software's OctoCloud

Summary

Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 14:20 UTC

CWE

CWE-639 - Authorization bypass through User-Controlled key

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
AKIN Software Computer Import-Export Industry and Trade Co. Ltd.	OctoCloud	Affected: 1.12.06 , < 1.12.07 (semver)

Date Public

2026-10-08 11:27

Credits

Berat ARSLAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-19083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:20:45.639814Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:20:53.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OctoCloud",
          "vendor": "AKIN Software Computer Import-Export Industry and Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "1.12.07",
              "status": "affected",
              "version": "1.12.06",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Berat ARSLAN"
        }
      ],
      "datePublic": "2026-10-08T11:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects OctoCloud: from 1.12.06 before 1.12.07.\u003c/p\u003e"
            }
          ],
          "value": "Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects OctoCloud: from 1.12.06 before 1.12.07."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization bypass through User-Controlled key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T11:32:49.840Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1272"
        }
      ],
      "source": {
        "advisory": "TR-26-1272",
        "defect": [
          "TR-26-1272"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "IDOR in AKIN Software\u0027s OctoCloud",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-19083",
    "datePublished": "2026-10-08T11:32:49.840Z",
    "dateReserved": "2026-08-06T12:13:07.840Z",
    "dateUpdated": "2026-10-08T14:20:53.595Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85523 (GCVE-0-2026-85523)

Vulnerability from cvelistv5 – Published: 2026-10-06 13:55 – Updated: 2026-10-06 19:30

Title

OS Command Injection in Felisify Informatics' SambaBox

Summary

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 19:26 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Felisify Information Technologies Industry and Trade Inc.	SambaBox	Affected: 0 , < 5.4.1 (semver)

Date Public

2026-10-06 13:52

Credits

Eyyüb Ensar Demir

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85523",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:26:58.792809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:30:35.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SambaBox",
          "vendor": "Felisify Information Technologies Industry and Trade Inc.",
          "versions": [
            {
              "lessThan": "5.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eyy\u00fcb Ensar Demir"
        }
      ],
      "datePublic": "2026-10-06T13:52:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.\u003cp\u003eThis issue affects SambaBox: before 5.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection.\n\nThis issue affects SambaBox: before 5.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:55:32.647Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1258"
        }
      ],
      "source": {
        "advisory": "TR-26-1258",
        "defect": [
          "TR-26-1258"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "OS Command Injection in Felisify Informatics\u0027 SambaBox",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85523",
    "datePublished": "2026-10-06T13:55:32.647Z",
    "dateReserved": "2026-09-04T08:00:07.702Z",
    "dateUpdated": "2026-10-06T19:30:35.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82924 (GCVE-0-2026-82924)

Vulnerability from cvelistv5 – Published: 2026-10-06 13:33 – Updated: 2026-10-06 19:31

Title

PII Enumeration via Missing Rate Limiting in Pusula Communication's Expert Mail

Summary

Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 19:27 UTC

CWE

CWE-799 - Improper Control of Interaction Frequency

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Pusula Communication, IT, and Internet Industry and Trade Co. Ltd.	Expert Mail	Affected: 0 , ≤ 2026-09-18 (date)

Date Public

2026-10-06 13:30

Credits

Ajenk Göktuğ Kamalı

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82924",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:27:49.741888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:31:08.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Expert Mail",
          "vendor": "Pusula Communication, IT, and Internet Industry and Trade Co. Ltd.",
          "versions": [
            {
              "lessThanOrEqual": "2026-09-18",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ajenk G\u00f6ktu\u011f Kamal\u0131"
        }
      ],
      "datePublic": "2026-10-06T13:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force.\u003cp\u003eThis issue affects Expert Mail: through 2026-09-18.\u003c/p\u003e"
            }
          ],
          "value": "Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force.\n\nThis issue affects Expert Mail: through 2026-09-18."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-112",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-112 Brute Force"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-799",
              "description": "CWE-799 Improper Control of Interaction Frequency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:33:39.061Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1257"
        }
      ],
      "source": {
        "advisory": "TR-26-1257",
        "defect": [
          "TR-26-1257"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "PII Enumeration via Missing Rate Limiting in Pusula Communication\u0027s Expert Mail",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-82924",
    "datePublished": "2026-10-06T13:33:39.061Z",
    "dateReserved": "2026-08-31T11:50:23.517Z",
    "dateUpdated": "2026-10-06T19:31:08.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12380 (GCVE-0-2026-12380)

Vulnerability from cvelistv5 – Published: 2026-10-06 13:05 – Updated: 2026-10-06 19:31

Title

Reflected XSS in Akıllı Ticaret's E-Commerce Pack

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-10-06. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 19:25 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Akıllı Ticaret Software Technologies Ltd. Co.	E-Commerce Pack	Affected: 0 , ≤ 2026-10-06 (date)

Date Public

2026-10-06 13:01

Credits

Berat ARSLAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12380",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:25:46.732503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:31:14.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "E-Commerce Pack",
          "vendor": "Ak\u0131ll\u0131 Ticaret Software Technologies Ltd. Co.",
          "versions": [
            {
              "lessThanOrEqual": "2026-10-06",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Berat ARSLAN"
        }
      ],
      "datePublic": "2026-10-06T13:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Ak\u0131ll\u0131 Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS.\u003cp\u003eThis issue affects E-Commerce Pack: through 2026-10-06.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted early about this disclosure but did not respond in any way.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Ak\u0131ll\u0131 Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS.\n\nThis issue affects E-Commerce Pack: through 2026-10-06.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T13:05:16.655Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1256"
        }
      ],
      "source": {
        "advisory": "TR-26-1256",
        "defect": [
          "TR-26-1256"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Reflected XSS in Ak\u0131ll\u0131 Ticaret\u0027s E-Commerce Pack",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-12380",
    "datePublished": "2026-10-06T13:05:16.655Z",
    "dateReserved": "2026-06-16T09:16:51.632Z",
    "dateUpdated": "2026-10-06T19:31:14.540Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5782 (GCVE-0-2026-5782)

Vulnerability from cvelistv5 – Published: 2026-10-02 14:13 – Updated: 2026-10-05 12:50 Unsupported When Assigned

Title

Reflected XSS in MRV Technology's TurkHotspot

Summary

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was contacted and it was learned that the product is not supported.

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 16:49 UTC

CWE

CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
MRV Technology Foreign Trade Ltd. Co.	TurkHotspot	Affected: 0 , ≤ 2026-10-02 (date)

Date Public

2026-10-02 14:10

Credits

Yiğit DUMAN

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T16:49:16.985183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T16:49:32.625Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "TurkHotspot",
          "vendor": "MRV Technology Foreign Trade Ltd. Co.",
          "versions": [
            {
              "lessThanOrEqual": "2026-10-02",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yi\u011fit DUMAN"
        }
      ],
      "datePublic": "2026-10-02T14:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS.\u003cp\u003eThis issue affects TurkHotspot: through 2026-10-02.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted and it was learned that the product is not supported.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS.\n\nThis issue affects TurkHotspot: through 2026-10-02.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T12:50:39.437Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1245"
        }
      ],
      "source": {
        "advisory": "TR-26-1245",
        "defect": [
          "TR-26-1245"
        ],
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Reflected XSS in MRV Technology\u0027s TurkHotspot",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-5782",
    "datePublished": "2026-10-02T14:13:02.370Z",
    "dateReserved": "2026-04-08T08:43:59.844Z",
    "dateUpdated": "2026-10-05T12:50:39.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85215 (GCVE-0-2026-85215)

Vulnerability from cvelistv5 – Published: 2026-10-02 13:01 – Updated: 2026-10-02 13:01

Title

SQL Injection in GG Soft's Paperwork

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
GG Soft Software Services Inc.	Paperwork	Affected: 0 , ≤ 2026-09-09 (date)

Date Public

2026-10-02 13:00

Credits

Tezer Diren Can

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Paperwork",
          "vendor": "GG Soft Software Services Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2026-09-09",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tezer Diren Can"
        }
      ],
      "datePublic": "2026-10-02T13:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection.\u003cp\u003eThis issue affects Paperwork: through 2026-09-09.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection.\n\nThis issue affects Paperwork: through 2026-09-09."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T13:01:52.342Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1244"
        }
      ],
      "source": {
        "advisory": "TR-26-1244",
        "defect": [
          "TR-26-1244"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in GG Soft\u0027s Paperwork",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85215",
    "datePublished": "2026-10-02T13:01:52.342Z",
    "dateReserved": "2026-09-03T13:56:02.935Z",
    "dateUpdated": "2026-10-02T13:01:52.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11795 (GCVE-0-2026-11795)

Vulnerability from cvelistv5 – Published: 2026-10-02 12:42 – Updated: 2026-10-08 13:56

Title

User Enumeration in Softtr's E-Commerce Pack

Summary

Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 14:38 UTC

CWE

CWE-203 - Observable discrepancy

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Softtr Informatics Trading Limited Company	E-Commerce Pack	Affected: 0 , < 5.03.01.54 (semver)

Date Public

2026-10-02 12:32

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11795",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T14:38:27.710871Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T18:04:54.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "E-Commerce Pack",
          "vendor": "Softtr Informatics Trading Limited Company",
          "versions": [
            {
              "lessThan": "5.03.01.54",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-10-02T12:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting.\u003cp\u003eThis issue affects E-Commerce Pack: before 5.03.01.54.\u003c/p\u003e"
            }
          ],
          "value": "Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting.\n\nThis issue affects E-Commerce Pack: before 5.03.01.54."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-575",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-575 Account Footprinting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-203",
              "description": "CWE-203 Observable discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:56:50.499Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1243"
        }
      ],
      "source": {
        "advisory": "TR-26-1243",
        "defect": [
          "TR-26-1243"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "User Enumeration in Softtr\u0027s E-Commerce Pack",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-11795",
    "datePublished": "2026-10-02T12:42:19.549Z",
    "dateReserved": "2026-06-09T13:13:01.603Z",
    "dateUpdated": "2026-10-08T13:56:50.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85209 (GCVE-0-2026-85209)

Vulnerability from cvelistv5 – Published: 2026-10-02 11:58 – Updated: 2026-10-02 17:30

Title

IDOR in AVEZ Electronics's LMS

Summary

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System (LMS): through 2026-09-18.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 17:30 UTC

CWE

CWE-862 - Missing Authorization

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
AVEZ Electronics Communication Training and Consultancy Trade Inc.	Learning Management System (LMS)	Affected: 0 , ≤ 2026-09-18 (date)

Date Public

2026-10-02 11:51

Credits

Yagiz BİLGİLİ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85209",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T17:30:03.851094Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T17:30:23.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Learning Management System (LMS)",
          "vendor": "AVEZ Electronics Communication Training and Consultancy Trade Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2026-09-18",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yagiz B\u0130LG\u0130L\u0130"
        }
      ],
      "datePublic": "2026-10-02T11:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Learning Management System (LMS): through 2026-09-18.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Learning Management System (LMS): through 2026-09-18."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T11:58:15.723Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1242"
        }
      ],
      "source": {
        "advisory": "TR-26-1242",
        "defect": [
          "TR-26-1242"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "IDOR in AVEZ Electronics\u0027s LMS",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-85209",
    "datePublished": "2026-10-02T11:58:15.723Z",
    "dateReserved": "2026-09-03T13:15:56.086Z",
    "dateUpdated": "2026-10-02T17:30:23.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80298 (GCVE-0-2026-80298)

Vulnerability from cvelistv5 – Published: 2026-10-02 09:07 – Updated: 2026-10-02 17:16 Unsupported When Assigned

Title

SQL Injection in HAVELSAN's Sef - AI Chatbot Platform

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 17:15 UTC

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
HAVELSAN Inc.	Sef - AI Chatbot Platform	Affected: 0 , < 2.1 (custom)

Date Public

2026-10-02 09:05

Credits

Akıner KISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T17:15:57.667260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T17:16:29.516Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Sef - AI Chatbot Platform",
          "vendor": "HAVELSAN Inc.",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner KISA"
        }
      ],
      "datePublic": "2026-10-02T09:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection.\u003cp\u003eThis issue affects Sef - AI Chatbot Platform: before 2.1.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted and it was learned that the product is not supported.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection.\n\nThis issue affects Sef - AI Chatbot Platform: before 2.1.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T14:35:29.214Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241"
        }
      ],
      "source": {
        "advisory": "TR-26-1241",
        "defect": [
          "TR-26-1241"
        ],
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "SQL Injection in HAVELSAN\u0027s Sef - AI Chatbot Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-80298",
    "datePublished": "2026-10-02T09:07:52.553Z",
    "dateReserved": "2026-08-26T08:07:57.549Z",
    "dateUpdated": "2026-10-02T17:16:29.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80443 (GCVE-0-2026-80443)

Vulnerability from cvelistv5 – Published: 2026-10-02 09:04 – Updated: 2026-10-02 14:36 Unsupported When Assigned

Title

Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

Summary

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 13:32 UTC

CWE

CWE-295 - Improper certificate validation

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
HAVELSAN Inc.	Sef - AI Chatbot Platform	Affected: 0 , < 2.1 (custom)

Date Public

2026-10-02 09:02

Credits

Efe KIRBAŞ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80443",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T13:32:19.840781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T13:33:49.275Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Sef - AI Chatbot Platform",
          "vendor": "HAVELSAN Inc.",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Efe KIRBA\u015e"
        }
      ],
      "datePublic": "2026-10-02T09:02:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM).\u003cp\u003eThis issue affects Sef - AI Chatbot Platform: before 2.1.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted and it was learned that the product is not supported.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM).\n\nThis issue affects Sef - AI Chatbot Platform: before 2.1.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper certificate validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T14:36:56.031Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241"
        }
      ],
      "source": {
        "advisory": "TR-26-1241",
        "defect": [
          "TR-26-1241"
        ],
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN\u0027s  Sef - AI Chatbot Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-80443",
    "datePublished": "2026-10-02T09:04:40.529Z",
    "dateReserved": "2026-08-26T11:27:31.565Z",
    "dateUpdated": "2026-10-02T14:36:56.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80337 (GCVE-0-2026-80337)

Vulnerability from cvelistv5 – Published: 2026-10-02 09:01 – Updated: 2026-10-02 14:36 Unsupported When Assigned

Title

Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

Summary

Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 13:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
HAVELSAN Inc.	Sef - AI Chatbot Platform	Affected: 0 , < 2.1 (custom)

Date Public

2026-10-02 08:59

Credits

Akıner KISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T13:34:29.798433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T13:37:25.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Sef - AI Chatbot Platform",
          "vendor": "HAVELSAN Inc.",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner KISA"
        }
      ],
      "datePublic": "2026-10-02T08:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects Sef - AI Chatbot Platform: before 2.1.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted and it was learned that the product is not supported.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Sef - AI Chatbot Platform: before 2.1.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T14:36:15.584Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241"
        }
      ],
      "source": {
        "advisory": "TR-26-1241",
        "defect": [
          "TR-26-1241"
        ],
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN\u0027s Sef - AI Chatbot Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-80337",
    "datePublished": "2026-10-02T09:01:25.226Z",
    "dateReserved": "2026-08-26T08:49:47.739Z",
    "dateUpdated": "2026-10-02T14:36:15.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-80464 (GCVE-0-2026-80464)

Vulnerability from cvelistv5 – Published: 2026-10-02 08:58 – Updated: 2026-10-02 14:37 Unsupported When Assigned

Title

API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform

Summary

Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 13:15 UTC

CWE

CWE-918 - Server-Side request forgery (SSRF)

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
HAVELSAN Inc.	Sef - AI Chatbot Platform	Affected: 0 , < 2.1 (custom)

Date Public

2026-10-02 08:55

Credits

Akıner KISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T13:15:14.772765Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T13:15:56.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Sef - AI Chatbot Platform",
          "vendor": "HAVELSAN Inc.",
          "versions": [
            {
              "lessThan": "2.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ak\u0131ner KISA"
        }
      ],
      "datePublic": "2026-10-02T08:55:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery.\u003cp\u003eThis issue affects Sef - AI Chatbot Platform: before 2.1.\u0026nbsp;\u003cspan\u003eNOTE: The vendor was contacted and it was learned that the product is not supported.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery.\n\nThis issue affects Sef - AI Chatbot Platform: before 2.1.\u00a0NOTE: The vendor was contacted and it was learned that the product is not supported."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-664",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-664 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side request forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T14:37:39.177Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241"
        }
      ],
      "source": {
        "advisory": "TR-26-1241",
        "defect": [
          "TR-26-1241"
        ],
        "discovery": "UNKNOWN"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "API Tool Runner SSRF in HAVELSAN\u0027s Sef - AI Chatbot Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-80464",
    "datePublished": "2026-10-02T08:58:08.477Z",
    "dateReserved": "2026-08-26T12:33:11.120Z",
    "dateUpdated": "2026-10-02T14:37:39.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18782 (GCVE-0-2026-18782)

Vulnerability from cvelistv5 – Published: 2026-09-30 14:15 – Updated: 2026-09-30 15:28

Title

SQL Injection in Trex Digital Manufacturing's Trex MES

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:56 UTC

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Trex Digital Smart Manufacturing Systems Inc.	Trex MES	Affected: 0 , ≤ 2026-09-29 (date)

Credits

Hasan Hüseyin UYAR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:56:23.205678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:07.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Trex MES",
          "vendor": "Trex Digital Smart Manufacturing Systems Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2026-09-29",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasan H\u00fcseyin UYAR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.\u003cp\u003eThis issue affects Trex MES: through 2026-09-29.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.\n\nThis issue affects Trex MES: through 2026-09-29."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-108",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-108 Command Line Execution through SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T14:15:15.056Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225"
        }
      ],
      "source": {
        "advisory": "TR-26-1225",
        "defect": [
          "TR-26-1225"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in Trex Digital Manufacturing\u0027s Trex MES",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-18782",
    "datePublished": "2026-09-30T14:15:15.056Z",
    "dateReserved": "2026-08-04T08:08:46.916Z",
    "dateUpdated": "2026-09-30T15:28:07.132Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-18783 (GCVE-0-2026-18783)

Vulnerability from cvelistv5 – Published: 2026-09-30 14:12 – Updated: 2026-09-30 15:28

Title

Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

Summary

Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:56 UTC

CWE

CWE-306 - Missing authentication for critical function

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Trex Digital Smart Manufacturing Systems Inc.	Trex MES	Affected: 0 , ≤ 2026-09-29 (date)

Date Public

2026-09-30 14:07

Credits

Hasan Hüseyin UYAR

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:56:59.734462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:07.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Trex MES",
          "vendor": "Trex Digital Smart Manufacturing Systems Inc.",
          "versions": [
            {
              "lessThanOrEqual": "2026-09-29",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hasan H\u00fcseyin UYAR"
        }
      ],
      "datePublic": "2026-09-30T14:07:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.\u003cp\u003eThis issue affects Trex MES: through 2026-09-29.\u003c/p\u003e"
            }
          ],
          "value": "Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass.\n\nThis issue affects Trex MES: through 2026-09-29."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing authentication for critical function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T14:12:02.320Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225"
        }
      ],
      "source": {
        "advisory": "TR-26-1225",
        "defect": [
          "TR-26-1225"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing\u0027s Trex MES",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-18783",
    "datePublished": "2026-09-30T14:12:02.320Z",
    "dateReserved": "2026-08-04T08:08:48.638Z",
    "dateUpdated": "2026-09-30T15:28:07.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82307 (GCVE-0-2026-82307)

Vulnerability from cvelistv5 – Published: 2026-09-30 13:20 – Updated: 2026-09-30 14:25

Title

Multiple Vulnerabilities in Dolusoft Software's SOPLOG

Summary

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:25 UTC

CWE

CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Dolusoft Software Technologies	SOPLOG	Affected: 0 , < Soplog 2026.9.4.1 (semver)

Date Public

2026-09-30 13:18

Credits

Hamza Metin Gerdan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82307",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:25:11.142931Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T14:25:19.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SOPLOG",
          "vendor": "Dolusoft Software Technologies",
          "versions": [
            {
              "lessThan": "Soplog 2026.9.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hamza Metin Gerdan"
        }
      ],
      "datePublic": "2026-09-30T13:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.\u003cp\u003eThis issue affects SOPLOG: before Soplog 2026.9.4.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027) vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.\n\nThis issue affects SOPLOG: before Soplog 2026.9.4.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T13:20:43.406Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1224"
        }
      ],
      "source": {
        "advisory": "TR-26-1224",
        "defect": [
          "TR-26-1224"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Multiple Vulnerabilities in Dolusoft Software\u0027s SOPLOG",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-82307",
    "datePublished": "2026-09-30T13:20:43.406Z",
    "dateReserved": "2026-08-28T12:16:49.200Z",
    "dateUpdated": "2026-09-30T14:25:19.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86778 (GCVE-0-2026-86778)

Vulnerability from cvelistv5 – Published: 2026-09-30 12:59 – Updated: 2026-09-30 14:26

Title

Username Enumeration in Maksisoft Technology's Maksisoft Gym

Summary

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 14:26 UTC

CWE

CWE-204 - Observable response discrepancy

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Maksisoft Technology, IT, and Software Industry and Trade Inc.	Maksisoft Gym	Affected: 0.5.10 , < 0.5.11 (semver)

Date Public

2026-09-30 12:54

Credits

Özcan Ersan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T14:26:40.478516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T14:26:50.199Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Maksisoft Gym",
          "vendor": "Maksisoft Technology, IT, and Software Industry and Trade Inc.",
          "versions": [
            {
              "lessThan": "0.5.11",
              "status": "affected",
              "version": "0.5.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "\u00d6zcan Ersan"
        }
      ],
      "datePublic": "2026-09-30T12:54:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.\u003cp\u003eThis issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.\u003c/p\u003e"
            }
          ],
          "value": "Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.\n\nThis issue affects Maksisoft Gym: from 0.5.10 before 0.5.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-575",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-575 Account Footprinting"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204 Observable response discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T12:59:32.953Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1223"
        }
      ],
      "source": {
        "advisory": "TR-26-1223",
        "defect": [
          "TR-26-1223"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Username Enumeration in Maksisoft Technology\u0027s Maksisoft Gym",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-86778",
    "datePublished": "2026-09-30T12:59:32.953Z",
    "dateReserved": "2026-09-08T11:42:32.137Z",
    "dateUpdated": "2026-09-30T14:26:50.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86450 (GCVE-0-2026-86450)

Vulnerability from cvelistv5 – Published: 2026-09-29 13:46 – Updated: 2026-09-30 15:28

Title

Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal

Summary

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 15:18 UTC

CWE

CWE-201 - Insertion of sensitive information into sent data

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Parla Auto Automotive Trading Limited Company	DetaWix Mobile Web Portal	Affected: 0 , < v1.0.19 (semver)

Date Public

2026-09-29 13:43

Credits

Anonim

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T15:18:07.892513Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T15:28:20.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "DetaWix Mobile Web Portal",
          "vendor": "Parla Auto Automotive Trading Limited Company",
          "versions": [
            {
              "lessThan": "v1.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anonim"
        }
      ],
      "datePublic": "2026-09-29T13:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects DetaWix Mobile Web Portal: before v1.0.19.\u003c/p\u003e"
            }
          ],
          "value": "Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects DetaWix Mobile Web Portal: before v1.0.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201 Insertion of sensitive information into sent data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T13:46:39.350Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1210"
        }
      ],
      "source": {
        "advisory": "TR-26-1210",
        "defect": [
          "TR-26-1210"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive Data Exposure in Parla Auto\u0027s DetaWix Mobile Web Portal",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-86450",
    "datePublished": "2026-09-29T13:46:39.350Z",
    "dateReserved": "2026-09-07T12:54:00.924Z",
    "dateUpdated": "2026-09-30T15:28:20.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87748 (GCVE-0-2026-87748)

Vulnerability from cvelistv5 – Published: 2026-09-29 11:51 – Updated: 2026-09-29 14:58

Title

Privilege Escalation via Account Takeover in Interprobe's Qorela DC

Summary

Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 14:57 UTC

CWE

CWE-862 - Missing Authorization

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Interprobe Information Technologies Inc.	Qorela DC	Affected: 1.6.1-RC29 , < v1.6.2 (custom)

Date Public

2026-09-29 11:47

Credits

Alaeddin BERKSOY

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T14:57:52.117150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T14:58:53.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Qorela DC",
          "vendor": "Interprobe Information Technologies Inc.",
          "versions": [
            {
              "lessThan": "v1.6.2",
              "status": "affected",
              "version": "1.6.1-RC29",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alaeddin BERKSOY"
        }
      ],
      "datePublic": "2026-09-29T11:47:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.\u003cp\u003eThis issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse.\n\nThis issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T11:51:55.245Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1209"
        }
      ],
      "source": {
        "advisory": "TR-26-1209",
        "defect": [
          "TR-26-1209"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation via Account Takeover in Interprobe\u0027s Qorela DC",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-87748",
    "datePublished": "2026-09-29T11:51:55.245Z",
    "dateReserved": "2026-09-09T06:19:48.436Z",
    "dateUpdated": "2026-09-29T14:58:53.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90924 (GCVE-0-2026-90924)

Vulnerability from cvelistv5 – Published: 2026-09-28 13:53 – Updated: 2026-09-28 16:22

Title

Default Admin Credentials in Innotim Software's Logsign SIEM

Summary

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 15:46 UTC

CWE

CWE-1392 - Use of default credentials

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.	Logsign SIEM	Affected: 6.4.101 , < 6.4.117 (semver)

Date Public

2026-09-28 13:51

Credits

Mert Yeniay

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90924",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T15:46:57.029521Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:22:26.694Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Logsign SIEM",
          "vendor": "Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.",
          "versions": [
            {
              "lessThan": "6.4.117",
              "status": "affected",
              "version": "6.4.101",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mert Yeniay"
        }
      ],
      "datePublic": "2026-09-28T13:51:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords.\u003cp\u003eThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117.\u003c/p\u003e"
            }
          ],
          "value": "Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords.\n\nThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-70",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-70 Try Common or Default Usernames and Passwords"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1392",
              "description": "CWE-1392 Use of default credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T13:53:46.972Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1202"
        }
      ],
      "source": {
        "advisory": "TR-26-1202",
        "defect": [
          "TR-26-1202"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Default Admin Credentials in Innotim Software\u0027s Logsign SIEM",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-90924",
    "datePublished": "2026-09-28T13:53:46.972Z",
    "dateReserved": "2026-09-14T11:26:47.413Z",
    "dateUpdated": "2026-09-28T16:22:26.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90925 (GCVE-0-2026-90925)

Vulnerability from cvelistv5 – Published: 2026-09-28 13:50 – Updated: 2026-09-28 16:32

Title

Path Traversal in Innotim Software's Logsign SIEM

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 15:47 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.	Logsign SIEM	Affected: 6.4.101 , < 6.4.117 (semver)

Date Public

2026-09-28 13:48

Credits

Mert Yeniay

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90925",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T15:47:30.637428Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:32:27.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Logsign SIEM",
          "vendor": "Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.",
          "versions": [
            {
              "lessThan": "6.4.117",
              "status": "affected",
              "version": "6.4.101",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mert Yeniay"
        }
      ],
      "datePublic": "2026-09-28T13:48:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal.\u003cp\u003eThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117.\u003c/p\u003e"
            }
          ],
          "value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal.\n\nThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T13:50:31.840Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1202"
        }
      ],
      "source": {
        "advisory": "TR-26-1202",
        "defect": [
          "TR-26-1202"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Path Traversal in Innotim Software\u0027s Logsign SIEM",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-90925",
    "datePublished": "2026-09-28T13:50:31.840Z",
    "dateReserved": "2026-09-14T11:26:48.966Z",
    "dateUpdated": "2026-09-28T16:32:27.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90926 (GCVE-0-2026-90926)

Vulnerability from cvelistv5 – Published: 2026-09-28 13:47 – Updated: 2026-09-28 16:32

Title

Code Injection in Innotim Software's Logsign SIEM

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-28 15:47 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

TR-CERT CNA under the mitre root

CNA scorecard C 74/100 over 260 records in the last 180 days details

References

1 reference

URL	Tags
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

1 product

Vendor	Product	Version
Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.	Logsign SIEM	Affected: 6.4.101 , < 6.4.117 (semver)

Date Public

2026-09-28 13:43

Credits

Mert Yeniay

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90926",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T15:47:41.592488Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:32:28.001Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Logsign SIEM",
          "vendor": "Innotim Software, Telecommunications and Consultancy Trade Ltd. Co.",
          "versions": [
            {
              "lessThan": "6.4.117",
              "status": "affected",
              "version": "6.4.101",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mert Yeniay"
        }
      ],
      "datePublic": "2026-09-28T13:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection.\u003cp\u003eThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117.\u003c/p\u003e"
            }
          ],
          "value": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection.\n\nThis issue affects Logsign SIEM: from 6.4.101 before 6.4.117."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T13:47:09.605Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1202"
        }
      ],
      "source": {
        "advisory": "TR-26-1202",
        "defect": [
          "TR-26-1202"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Code Injection in Innotim Software\u0027s Logsign SIEM",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-90926",
    "datePublished": "2026-09-28T13:47:09.605Z",
    "dateReserved": "2026-09-14T11:26:50.253Z",
    "dateUpdated": "2026-09-28T16:32:28.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

856 vulnerabilities

CVE-2026-90983 (GCVE-0-2026-90983)

CVE-2026-92085 (GCVE-0-2026-92085)

CVE-2026-86405 (GCVE-0-2026-86405)

CVE-2026-85531 (GCVE-0-2026-85531)

CVE-2026-12859 (GCVE-0-2026-12859)

CVE-2026-89290 (GCVE-0-2026-89290)

CVE-2026-91844 (GCVE-0-2026-91844)

CVE-2026-19218 (GCVE-0-2026-19218)

CVE-2026-92555 (GCVE-0-2026-92555)

CVE-2026-19083 (GCVE-0-2026-19083)

CVE-2026-85523 (GCVE-0-2026-85523)

CVE-2026-82924 (GCVE-0-2026-82924)

CVE-2026-12380 (GCVE-0-2026-12380)

CVE-2026-5782 (GCVE-0-2026-5782)

CVE-2026-85215 (GCVE-0-2026-85215)

CVE-2026-11795 (GCVE-0-2026-11795)

CVE-2026-85209 (GCVE-0-2026-85209)

CVE-2026-80298 (GCVE-0-2026-80298)

CVE-2026-80443 (GCVE-0-2026-80443)

CVE-2026-80337 (GCVE-0-2026-80337)

CVE-2026-80464 (GCVE-0-2026-80464)

CVE-2026-18782 (GCVE-0-2026-18782)

CVE-2026-18783 (GCVE-0-2026-18783)

CVE-2026-82307 (GCVE-0-2026-82307)

CVE-2026-86778 (GCVE-0-2026-86778)

CVE-2026-86450 (GCVE-0-2026-86450)

CVE-2026-87748 (GCVE-0-2026-87748)

CVE-2026-90924 (GCVE-0-2026-90924)

CVE-2026-90925 (GCVE-0-2026-90925)

CVE-2026-90926 (GCVE-0-2026-90926)