EUVD-2026-68508
GHSA-qpwj-9fr5-p7fq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable panel with low-privilege auth required; full database read/write/delete impact justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection.
This issue affects Site Management Panel: through 15062026.
AnalysisAI
SQL injection in Ankara Hosting's Site Management Panel through version 15062026 enables authenticated remote attackers to manipulate backend database queries with full impact on confidentiality, integrity, and availability. The CVSS score of 8.8 (PR:L) reflects that low-privilege panel credentials are required but attack complexity is minimal once access is obtained. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Low-privilege authenticated access to the Ankara Hosting Site Management Panel is required, as indicated by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is well-supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: the attack is fully network-exploitable with no user interaction and low complexity, but requires at minimum low-privilege authenticated access to the panel. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0955 should be consulted for vendor-specific patch guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Ankara Hosting Site Management Panel and verify the installed version; immediately disable panel access for non-essential users and enforce multi-factor authentication on remaining accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today