CVE-2026-2395 - Vulnerability Details - OpenCVE

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.3.1.0 through 20260722. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Xpoda Turkiye Information Technology	No Code Platform

No data.

No data.

References

Link	Providers
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608

History

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Xpoda Turkiye Information Technology Xpoda Turkiye Information Technology no Code Platform
Vendors & Products		Xpoda Turkiye Information Technology Xpoda Turkiye Information Technology no Code Platform

Wed, 22 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 22 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.3.1.0 through 20260722. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Title		SQLi in Xpoda Türkiye Informatics Technology's No Code Platform
Weaknesses		CWE-89
References		https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2026-07-22T14:02:07.808Z

Updated: 2026-07-22T18:58:48.035Z

Reserved: 2026-02-12T12:48:07.234Z

Link: CVE-2026-2395

Vulnrichment

Updated: 2026-07-22T18:58:44.534Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2395", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-02-12T12:48:07.234Z", "datePublished": "2026-07-22T14:02:07.808Z", "dateUpdated": "2026-07-22T18:58:48.035Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-22T14:02:07.808Z"}, "title": "SQLi in Xpoda T\u00fcrkiye Informatics Technology's No Code Platform", "datePublic": "2026-07-22T13:57:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"vendor": "Xpoda T\u00fcrkiye Informatics Technology Inc.", "product": "No Code Platform", "versions": [{"status": "affected", "version": "4.3.1.0", "lessThanOrEqual": "20260722", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda T\u00fcrkiye Informatics Technology Inc. No Code Platform allows SQL Injection.\n\nThis issue affects No Code Platform: from 4.3.1.0 through 20260722.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda T\u00fcrkiye Informatics Technology Inc. No Code Platform allows SQL Injection.<p>This issue affects No Code Platform: from 4.3.1.0 through 20260722. <span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Murat ERDEM\u0130R", "type": "finder"}], "source": {"defect": ["TR-26-0608"], "advisory": "TR-26-0608", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T18:58:36.700333Z", "id": "CVE-2026-2395", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:58:48.035Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T18:58:36.700333Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-22T18:58:44.534Z"}}], "cna": {"title": "SQLi in Xpoda T\u00fcrkiye Informatics Technology's No Code Platform", "source": {"defect": ["TR-26-0608"], "advisory": "TR-26-0608", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Murat ERDEM\u0130R"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Xpoda T\u00fcrkiye Informatics Technology Inc.", "product": "No Code Platform", "versions": [{"status": "affected", "version": "4.3.1.0", "versionType": "custom", "lessThanOrEqual": "20260722"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-22T13:57:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda T\u00fcrkiye Informatics Technology Inc. No Code Platform allows SQL Injection.\n\nThis issue affects No Code Platform: from 4.3.1.0 through 20260722.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda T\u00fcrkiye Informatics Technology Inc. No Code Platform allows SQL Injection.<p>This issue affects No Code Platform: from 4.3.1.0 through 20260722. <span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-07-22T14:02:07.808Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2395", "state": "PUBLISHED", "dateUpdated": "2026-07-22T18:58:48.035Z", "dateReserved": "2026-02-12T12:48:07.234Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-07-22T14:02:07.808Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}