What is the CVSS score of CVE-2026-7486?

CVE-2026-7486 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of E-İmar are affected by CVE-2026-7486?

Netcad Software's E-İmar urban planning and permit management platform (versions 2.10.1.0 through 3.0.2) contains a critical SQL injection vulnerability (CVSS 9.8) allowing unauthenticated remote…. A patch is available.

How to fix or mitigate CVE-2026-7486?

24 hours: Inventory all E-İmar deployments, identify affected versions, and map network connectivity and data sensitivity. 7 days: Implement interim controls-restrict network access to E-İmar via firewall (administrative IP allowlisting), deploy Web Application Firewall (WAF) with SQL injection detection rules, enable comprehensive database transaction logging, and activate verified backup/restore procedures. 30 days: Contact Netcad Software for patch timeline and fixed version availability; if no patch timeline provided, evaluate alternative urban planning platforms or establish formal security update commitment from vendor.

E-İmar CVE-2026-7486

EUVD-2026-35425 CRITICAL

SQL Injection (CWE-89)

2026-06-09 TR-CERT

GHSA-wmxv-4gxc-8g7h

SQLi E I Mar

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 15:01 EUVD

Analysis Generated

Jun 09, 2026 - 13:50 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection.

This issue affects E-İmar: from 2.10.1.0 before 3.0.2.

AnalysisAI

SQL injection in Netcad Software's E-İmar urban planning/permit management platform (versions 2.10.1.0 through 3.0.2) allows remote unauthenticated attackers to manipulate backend database queries via crafted input. The CVSS 9.8 rating reflects network-reachable exploitation with no authentication or user interaction required, leading to full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, but the disclosure by Turkey's national CERT (TR-CERT) indicates coordinated vendor notification.

Technical ContextAI

E-İmar is a Netcad Software product used by Turkish municipalities for electronic zoning, construction permit, and urban planning workflows - a regulated government-facing application that typically stores citizen identity data, parcel/cadastral records, and permit documents. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL statements without parameterization or adequate escaping. The CPE 'cpe:2.3:a:netcad_software_inc.:e-i̇mar:*:*:*:*:*:*:*:*' covers all versions, but the description narrows the impact window to 2.10.1.0 up to (but not including) 3.0.2. The specific injectable parameter, endpoint, and database backend are not disclosed in the public advisory.

RemediationAI

Vendor-released patch: upgrade E-İmar to version 3.0.2 or later, which contains the fix per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0343. Until the upgrade is deployed, restrict network exposure of the E-İmar application by placing it behind a VPN or municipal-network-only ACL (trade-off: blocks legitimate public-facing permit submissions if exposed externally), and deploy a WAF with strict SQL injection signature rules in front of the application (trade-off: signature-based detection can be bypassed via encoding and may produce false positives on parameters that legitimately contain SQL-like characters). Enable database query logging and review for anomalous UNION, sleep, or stacked-query patterns on the E-İmar database during the exposure window.