{"id":"CVE-2026-18630","state":"PUBLISHED","title":"SQL Injection in TMT Machine's Talassoft Industrial Management Software","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection.\n\nThis issue affects Talassoft Industrial Management Software: from V.4 before V.16.","publishedAt":"2026-09-01T15:08:50.285Z","updatedAt":"2026-09-01T15:21:49.187Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"TR-CERT"},"assigner":"TR-CERT","products":["TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software"],"affected":[{"vendor":"TMT Machine Industry and Trade Ltd. Co.","product":"Talassoft Industrial Management Software","defaultStatus":"unaffected","versions":[{"version":"V.4","status":"affected","lessThan":"V.16","versionType":"custom"}]}],"references":["https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0965"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/18xxx/CVE-2026-18630.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18630","state":"PUBLISHED","datePublished":"2026-09-01T15:08:50.285Z","dateUpdated":"2026-09-01T15:21:49.187Z","assignerShortName":"TR-CERT","assignerOrgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateReserved":"2026-08-03T09:24:46.122Z"},"containers":{"cna":{"title":"SQL Injection in TMT Machine's Talassoft Industrial Management Software","descriptions":[{"lang":"en","value":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection.\n\nThis issue affects Talassoft Industrial Management Software: from V.4 before V.16."}],"affected":[{"vendor":"TMT Machine Industry and Trade Ltd. Co.","product":"Talassoft Industrial Management Software","defaultStatus":"unaffected","versions":[{"version":"V.4","status":"affected","lessThan":"V.16","versionType":"custom"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0965","tags":["government-resource"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"TR-CERT","orgId":"ca940d4e-fea4-4aa2-9a58-591a58b1ce21","dateUpdated":"2026-09-01T15:08:50.285Z"},"datePublic":"2026-09-01T15:06:00.000Z","impacts":[{"capecId":"CAPEC-66","descriptions":[{"lang":"en","value":"CAPEC-66 SQL Injection"}]}],"credits":[{"lang":"en","value":"Efe Özel","type":"finder"},{"lang":"en","value":"Cemil Sefa Özcan","type":"analyst"},{"lang":"en","value":"FORDEFENCE","type":"sponsor"}],"source":{"defect":["TR-26-0965"],"advisory":"TR-26-0965","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-01T15:21:34.762413Z","id":"CVE-2026-18630","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-01T15:21:49.187Z"}}]}}}