EUVD-2026-75293
GHSA-8fwr-wm9v-pw26
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQL injection with no user interaction; SQLi can read and modify database contents and disrupt availability, justifying C:H/I:H/A:H.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection.
This issue affects Access Control System: before Versiyon 2.
AnalysisAI
SQL injection in Armiya Information Technologies' Access Control System (all versions before Versiyon 2) lets remote attackers inject arbitrary SQL through improperly neutralized input, per the CVSS 3.1 vector without prior authentication. Because this is a physical/logical access-control platform, successful injection can expose or manipulate the backing database of credentials, cardholders, and access rules. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector indicates AV:N/AC:L/PR:N/UI:N, i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes a network-reachable, unauthenticated, low-complexity flaw with full confidentiality, integrity, and availability impact - a maximal-severity profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Access Control System Versiyon 2 or later, which is the fixed release boundary indicated by the affected-version range; consult the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1061) for vendor-specific upgrade guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: isolate all Armiya Access Control System instances from untrusted networks through network segmentation and disable external access via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Access Control System
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today