EUVD-2026-69284
GHSA-532w-xx5j-hxxw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable SQL injection requiring only a low-privileged account; full database C/I/A impact with no scope change.
Primary rating from Vendor (usom).
CVSS VectorVendor: usom
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection.
This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
AnalysisAI
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged user account on the Talassoft application (consistent with PR:L in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 and accurately reflects a dangerous SQL injection exploitable by any authenticated network user with minimal effort. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Talassoft Industrial Management Software to version V.16 or later, which represents the fixed release per the version range disclosed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct inventory of all Talassoft V.4-V.16 deployments, identify external user access, and implement network-level restrictions limiting database access to essential systems only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today