What is the CVSS score of CVE-2026-5134?

CVE-2026-5134 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Loca CMS are affected by CVE-2026-5134?

Loca Software Informatics Technology Ltd. Co. CMS versions up to build 06082026 contain a critical SQL injection vulnerability (CVSS 9.8) allowing unauthenticated remote attackers to read, modify, or…

How to fix or mitigate CVE-2026-5134?

Within 24 hours, identify all systems running affected CMS builds and take inventory of hosted data sensitivity; immediately restrict network access to CMS instances to trusted networks only and block direct internet exposure. Within 7 days, deploy SQL injection prevention rules in any Web Application Firewall protecting the CMS, enable database activity monitoring with alerts for unusual query patterns, and implement database user access restrictions to least-privilege accounts. Within 30 days, escalate vendor engagement or evaluate migration to alternative CMS platforms; audit full database backups for integrity and test recovery procedures to ensure data restoration capability in event of compromise.

Loca CMS CVE-2026-5134

EUVD-2026-53928 CRITICAL

SQL Injection (CWE-89)

2026-08-06 TR-CERT

GHSA-3xp3-p74q-7g2c

SQLi Cms

9.8

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection (PR:N/AV:N/AC:L) yielding full database read, modification, and denial, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

9.8 CRITICAL

qualitative

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 14:20 vuln.today

CVE Published

Aug 06, 2026 - 13:31 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.

This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in Loca Software Informatics Technology Ltd. Co. CMS (all versions up to and including build 06082026) allows remote unauthenticated attackers to inject arbitrary SQL through improperly neutralized input, per CVSS PR:N. Disclosed by Turkey's national CERT (TR-CERT/USOM), the flaw carries a critical 9.8 score with full confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor was contacted but did not respond, so no fix is available.

Technical ContextAI

The affected product is a web-based content management system (CMS) developed by the Turkish vendor Loca Software Informatics Technology Ltd. Co., identified by CPE cpe:2.3:a:loca_software_informatics_technology_ltd._co.:cms. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL queries without parameterization or proper escaping, allowing an attacker to alter query logic. This is the classic SQLi pattern in PHP/database-driven CMS applications where request parameters flow directly into backend database calls.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor was contacted early but did not respond in any way, and the CVE covers all versions through 06082026. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771 for any updates. As compensating controls, place the application behind a Web Application Firewall with SQL injection signatures tuned to block tautologies and UNION-based payloads (accepting some false-positive risk on legitimate queries), restrict network exposure of the CMS admin and dynamic endpoints to trusted IPs or VPN to remove unauthenticated internet reachability, enforce least-privilege database accounts so the CMS DB user cannot read foreign schemas or execute file/OS operations (limiting blast radius but not preventing injection), and enable database query logging to detect anomalous statements. If feasible, migrating off this unmaintained CMS should be evaluated given the unresponsive vendor.