CVE-2026-5134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5134", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-03-30T10:11:27.574Z", "datePublished": "2026-08-06T13:31:45.358Z", "dateUpdated": "2026-08-06T14:42:41.239Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-06T13:31:45.358Z"}, "title": "SQLi in Loca Software's CMS", "datePublic": "2026-08-06T13:28:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"vendor": "Loca Software Informatics Technology Ltd. Co.", "product": "CMS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "06082026", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.<p>This issue affects CMS: through 06082026.&nbsp;<span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Onur KARA", "type": "finder"}], "source": {"defect": ["TR-26-0771"], "advisory": "TR-26-0771", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T14:42:33.207183Z", "id": "CVE-2026-5134", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:42:41.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T14:42:33.207183Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:42:38.317Z"}}], "cna": {"title": "SQLi in Loca Software's CMS", "source": {"defect": ["TR-26-0771"], "advisory": "TR-26-0771", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Onur KARA"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Loca Software Informatics Technology Ltd. Co.", "product": "CMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "06082026"}], "defaultStatus": "unknown"}], "datePublic": "2026-08-06T13:28:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.<p>This issue affects CMS: through 06082026.&nbsp;<span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-06T13:31:45.358Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5134", "state": "PUBLISHED", "dateUpdated": "2026-08-06T14:42:41.239Z", "dateReserved": "2026-03-30T10:11:27.574Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-08-06T13:31:45.358Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "CMS", "vendor": "Loca Software Informatics Technology Ltd. Co.", "versions": [{"lessThanOrEqual": "06082026", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL (inyecci\u00f3n SQL) vulnerabilidad en Loca Software Informatics Technology Ltd. Co. CMS permite la inyecci\u00f3n SQL.\n\nEste problema afecta a CMS: hasta el 06082026. NOTA: El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5134", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5134", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T14:42:33.207183Z", "version": "2.0.3"}}]}, "published": "2026-08-06T14:16:36.840", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{"bugzilla": {"description": "Loca Software Informatics Technology Ltd. Co. CMS: CMS: Critical SQL Injection vulnerability", "id": "2512052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512052"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-89", "details": ["Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "A flaw was found in CMS. This vulnerability, known as SQL injection, allows a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. This can lead to unauthorized access to sensitive data, modification of database content, and disruption of service, resulting in a critical impact on confidentiality, integrity, and availability."], "name": "CVE-2026-5134", "public_date": "2026-08-06T13:31:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-5134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5134\nhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771"], "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,06082026]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "CMS", "source": "cna", "vendor": "Loca Software Informatics Technology Ltd. Co."}, "product": "cms", "vendor": "loca_software_informatics_technology"}], "created": "2026-08-06T16:30:04.468313+00:00", "updated": "2026-08-07T10:00:45.965765+00:00", "vendors": ["loca_software_informatics_technology", "loca_software_informatics_technology$PRODUCT$cms"]}