CVE-2026-19733

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19733", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-08-13T13:23:27.917Z", "datePublished": "2026-09-09T09:19:08.279Z", "dateUpdated": "2026-09-09T12:47:16.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-09-09T09:19:08.279Z"}, "title": "SSRF in Yordam Informatics's Library Automation System", "datePublic": "2026-09-09T09:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "affected": [{"vendor": "Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.", "product": "Library Information and Document Automation Program", "versions": [{"status": "affected", "version": "0", "lessThan": "v22.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery.\n\nThis issue affects Library Information and Document Automation Program: before v22.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery.<p>This issue affects Library Information and Document Automation Program: before v22.2.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1036", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "\u0130remnur YILMAZ", "type": "finder"}], "source": {"defect": ["TR-26-1036"], "advisory": "TR-26-1036", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T12:46:58.550472Z", "id": "CVE-2026-19733", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T12:47:16.759Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19733", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-08-13T13:23:27.917Z", "datePublished": "2026-09-09T09:19:08.279Z", "dateUpdated": "2026-09-09T12:47:16.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-09-09T09:19:08.279Z"}, "title": "SSRF in Yordam Informatics's Library Automation System", "datePublic": "2026-09-09T09:15:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "CWE-918 Server-Side request forgery (SSRF)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "affected": [{"vendor": "Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.", "product": "Library Information and Document Automation Program", "versions": [{"status": "affected", "version": "0", "lessThan": "v22.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery.\n\nThis issue affects Library Information and Document Automation Program: before v22.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery.<p>This issue affects Library Information and Document Automation Program: before v22.2.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1036", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "\u0130remnur YILMAZ", "type": "finder"}], "source": {"defect": ["TR-26-1036"], "advisory": "TR-26-1036", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19733", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-09T12:46:58.550472Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T12:47:09.315Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Library Information and Document Automation Program", "vendor": "Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc.", "versions": [{"lessThan": "v22.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery.\n\nThis issue affects Library Information and Document Automation Program: before v22.2."}], "id": "CVE-2026-19733", "lastModified": "2026-09-09T15:37:49.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19733", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-09T12:46:58.550472Z", "version": "2.0.3"}}]}, "published": "2026-09-09T10:17:04.990", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1036"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v22.2)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 97.0, "source": "matching"}]}, "original": {"product": "Library Information and Document Automation Program", "source": "cna", "vendor": "Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc."}, "product": "library_information_and_document_automation_program", "vendor": "yordam_information_technology_consulting,_training_and_electronic_systems_industry_and_trade_inc."}], "created": "2026-09-09T11:15:10.106791+00:00", "updated": "2026-09-13T19:45:17.604697+00:00", "vendors": ["yordam_information_technology_consulting,_training_and_electronic_systems_industry_and_trade_inc.", "yordam_information_technology_consulting,_training_and_electronic_systems_industry_and_trade_inc.$PRODUCT$library_information_and_document_automation_program"]}