What is the CVSS score of CVE-2025-6577?

CVE-2025-6577 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Akilli Commerce E-Commerce Website are affected by CVE-2025-6577?

Akilli Commerce E-Commerce Website versions before 4.5.001 contain a critical unauthenticated SQL injection vulnerability (CVSS 9.8) that allows remote attackers to gain complete database access,…. A patch is available.

How to fix or mitigate CVE-2025-6577?

Within 24 hours: Identify all Akilli Commerce instances and confirm versions running before 4.5.001; isolate affected systems from external network access if upgrade is not immediately feasible. Within 7 days: Apply vendor patch to version 4.5.001 or later on all instances; conduct database integrity audit for unauthorized access or modifications. Within 30 days: Perform forensic review of database access logs for the CVE exploitation signature; reset customer authentication credentials as precaution; notify customers if any data extraction is confirmed during audit.

Akilli Commerce E-Commerce Website CVE-2025-6577

EUVD-2025-209783 CRITICAL

SQL Injection (CWE-89)

2026-05-12 TR-CERT

GHSA-h999-6ppq-jh7h

SQLi E Commerce Website

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 12, 2026 - 11:01 EUVD

Analysis Generated

May 12, 2026 - 10:30 vuln.today

CVE Published

May 12, 2026 - 09:31 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection.

This issue affects E-Commerce Website: before 4.5.001.

AnalysisAI

SQL injection in Akilli Commerce E-Commerce Website versions before 4.5.001 allows remote unauthenticated attackers to execute arbitrary SQL commands with complete database access. The vulnerability permits extraction of sensitive customer and transaction data, modification of product catalogs and pricing, and potential complete system compromise. CVSS score of 9.8 (Critical) reflects network-accessible exploitation requiring no authentication or user interaction, though no active exploitation has been reported in CISA KEV and EPSS data is not available.

Technical ContextAI

The vulnerability stems from CWE-89 (SQL Injection), where the E-Commerce Website platform fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. Affecting the Akilli Commerce Software Technologies E-Commerce Website platform (CPE: cpe:2.3:a:akilli_commerce_software_technologies_ltd._co.:e-commerce_website), this class of vulnerability typically occurs in web application endpoints handling user input such as search fields, product filters, login forms, or checkout processes. Without prepared statements or input validation, attackers can inject malicious SQL syntax to manipulate database queries, bypassing authentication mechanisms, extracting data through UNION-based or blind injection techniques, or executing administrative database commands.

RemediationAI

Upgrade immediately to Akilli Commerce E-Commerce Website version 4.5.001 or later, which contains fixes for the SQL injection vulnerability per TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0222. Organizations unable to patch immediately should implement layered compensating controls: deploy a Web Application Firewall (WAF) with SQL injection rulesets to block common attack patterns, though sophisticated attacks may bypass signature-based detection; restrict database user permissions to minimum required operations (read-only where possible, no DROP/ALTER privileges) to limit injection impact, though data exfiltration remains possible; implement database activity monitoring to detect anomalous query patterns such as UNION statements or excessive row returns; isolate the application database on a separate network segment with strict firewall rules. Note that workarounds provide defense-in-depth but do not eliminate the vulnerability-patching to version 4.5.001 remains the only complete remediation. Contact Akilli Commerce support channels for patch deployment assistance and verify post-patch that all application functionality remains operational.