What is the CVSS score of CVE-2026-4321?

CVE-2026-4321 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Destekz are affected by CVE-2026-4321?

Raera's Destekz help-desk platform contains a critical SQL injection vulnerability allowing unauthenticated attackers to read, modify, or delete backend database contents without authentication.

How to fix or mitigate CVE-2026-4321?

Within 24 hours: Inventory all Destekz instances and identify what customer/operational data is stored; assess data sensitivity and breach notification obligations. Within 7 days: Implement network segmentation to restrict Destekz access, deploy WAF rules blocking SQL metacharacters in input, and enable database-level audit logging for anomalous queries. Within 30 days: Execute migration plan to a supported replacement platform or issue vendor end-of-life notice to stakeholders with decommission timeline.

Destekz CVE-2026-4321

EUVD-2026-41526 CRITICAL

SQL Injection (CWE-89)

2026-07-03 TR-CERT

GHSA-fvc7-x7g6-74xj

SQLi Destekz

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network SQL injection with no user interaction (AV:N/AC:L/PR:N/UI:N) grants full read/write/destroy access to the backend database, so C/I/A are all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 10:20 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection.

This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.

AnalysisAI

SQL injection in Raera's Destekz support/help-desk application (all versions through 02062026) allows remote attackers to inject arbitrary SQL via unsanitized input, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicating unauthenticated network exploitation. TR-CERT rates this critical (9.8) with full confidentiality, integrity, and availability impact, meaning an attacker can read, modify, or destroy backend database contents. No public exploit identified at time of analysis, but the vendor has confirmed the product is no longer supported, so no fix will be issued.

Technical ContextAI

The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) weakness, in which user-controlled input is concatenated directly into SQL statements without parameterization or escaping, letting an attacker alter query logic. The affected product is Destekz, a web application by 'Raera - Ankara Web Design and Digital Advertising Agency' (CPE cpe:2.3:a:raera_-_ankara_web_design_and_digital_advertising_agency:destekz:*), most likely a PHP/MySQL support-ticket or contact module given its origin as an agency-built web product. Because SQL injection operates at the data-access layer, the specific injectable parameter and endpoint are not disclosed in the advisory, but the CWE root cause is unambiguous.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor has confirmed Destekz is no longer supported, so no fix version will be published; the strategic remediation is to decommission and migrate off Destekz entirely. Until removal, apply specific compensating controls: place the application behind a WAF with SQL-injection rule sets tuned to block tautologies, UNION-based, and stacked-query payloads (accepting possible false positives on legitimate special characters); restrict network access to the application to trusted IPs or an internal VPN to remove unauthenticated internet reachability (trade-off: breaks public-facing use); enforce least-privilege on the database account used by the app (revoke DDL/administrative rights and cross-database access to limit blast radius); and enable database query logging to detect anomalous statements. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0488 for any updated guidance.