What is the CVSS score of CVE-2026-2395?

CVE-2026-2395 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Xpoda are affected by CVE-2026-2395?

Xpoda No Code Platform versions 4.3.1.0 through build 20260722 contain a critical SQL injection vulnerability accessible to remote unauthenticated attackers, enabling complete compromise of the…

How to fix or mitigate CVE-2026-2395?

Within 24 hours: identify and audit all running instances of Xpoda No Code Platform versions 4.3.1.0 through 20260722 in your infrastructure, then isolate them from production networks or shut down non-critical deployments immediately; initiate contact with Xpoda support to request a patched version and ETA. Within 7 days: conduct a forensic review of database access logs to identify any unauthorized SQL queries or potential exploitation attempts, and brief executive stakeholders on findings and risk timeline. Within 30 days: either decommission Xpoda entirely and migrate to an alternative solution, or implement compensating controls (WAF rules for SQL injection detection, database query allowlisting, real-time database activity monitoring, and network segmentation) as temporary interim protections while demanding a patched version from the vendor.

Xpoda CVE-2026-2395

EUVD-2026-47703 CRITICAL

SQL Injection (CWE-89)

2026-07-22 TR-CERT

GHSA-wm9c-mg5f-4mpg

SQLi No Code Platform

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-auth network-reachable SQL injection with no user interaction gives AV:N/AC:L/PR:N/UI:N, and full database read/write/destroy potential yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 15:15 vuln.today

CVE Published

Jul 22, 2026 - 14:02 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection.

This issue affects No Code Platform: from 4.3.1.0 through 20260722. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.

Technical ContextAI

Xpoda is a low-code/no-code application development platform, meaning user-defined forms, workflows, and data models are translated into database operations at runtime. The vulnerability is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw, where user-controlled input is concatenated into SQL statements without parameterization or adequate sanitization. In no-code platforms this class is especially dangerous because dynamically generated queries built from user-configurable fields frequently bypass ORM-style protections. The single CPE identifier cpe:2.3:a:xpoda_türkiye_informatics_technology_inc.:no_code_platform:*:*:*:*:*:*:*:* confirms the affected product is the application-tier No Code Platform across all sub-versions in the stated range.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor did not respond to TR-CERT's disclosure attempts, so an upgrade path cannot be cited. In the absence of a fix, restrict network exposure of the Xpoda No Code Platform by placing it behind a VPN or IP allowlist so it is not internet-facing, and deploy a web application firewall with SQL injection signatures in front of the application to filter malicious query payloads (accepting that WAF rules can be bypassed and may cause false positives on legitimate no-code query builders). Enforce least-privilege on the database account used by the platform to limit the blast radius of a successful injection, and enable database query logging and monitoring to detect anomalous statements. Monitor the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608 for any future vendor response, and consider decommissioning or isolating the platform if it processes sensitive data and cannot be adequately protected.