Inventory Tracking Application CVE-2026-74993

The affected software must be deployed and network-reachable (the single reference is a Turkish national CERT bulletin, suggesting primarily Turkish deployments). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, so exposed instances up to and including the 2026-10-16 build are reachable by remote unauthenticated attackers against default configurations. The available sources do not identify the specific vulnerable endpoint, parameter, protocol, or configuration setting that triggers the SQL injection - the exact trigger is not described in the available sources. The principal limiting factor is deployment scarcity: the product has a very small installed base, and only internet- or network-exposed instances are at practical risk.

This is a network-exploitable SQL injection (CWE-89) with a vendor/NVD CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High). The scoring signals easy, remote, unauthenticated exploitation (PR:N) with high confidentiality impact but no integrity or availability impact - consistent with data exfiltration rather than data tampering or service disruption. The vuln.today decision label is 'this_week', indicating elevated but not emergency priority. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference are present in the input, so there is no evidence of active exploitation or published exploit code at time of analysis. The practical risk ceiling is therefore lower than the raw 7.5 suggests for most organizations because the affected software - an inventory tracking application from a single, apparently Turkish vendor (Starnet Computer and Network Systems) - has a very limited real-world footprint. The main limiting factor on risk is prevalence, not exploitability: where the product IS deployed and internet-exposed, an unauthenticated attacker could read database contents, but the population of exposed instances is likely small. Note: the affected-version field is expressed only as a date range ('through 2026-10-16') with no discrete fixed version, and no vendor advisory URL beyond the TR national CERT bulletin is provided, so exact patch status could not be independently confirmed.

An unauthenticated remote attacker identifies a web-facing input (e.g., a search, login, or query parameter) in the Inventory Tracking Application that is not properly sanitized and injects crafted SQL to read back database contents such as credentials or inventory/business records. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability and a single crafted request, with no authentication or user interaction. No public exploit code or PoC reference is identified in the available sources, so any exploitation would currently require an attacker to develop their own payload.