What is the CVSS score of CVE-2026-8297?

CVE-2026-8297 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of GisLab Laboratory Management System are affected by CVE-2026-8297?

GisLab Laboratory Management System versions 1.4.03-08072026 contain a critical unauthenticated SQL injection vulnerability enabling remote attackers to fully compromise laboratory databases,…

How to fix or mitigate CVE-2026-8297?

Within 24 hours: Inventory all GisLab Laboratory Management System deployments currently running versions 1.4.03 through 08072026; isolate affected instances from public networks using firewall rules or network segmentation; enable comprehensive database access logging to detect suspicious query patterns. Within 7 days: Contact GisLab vendor (TR-CERT advisory TR-26-0573) for confirmed patch availability and timeline; deploy Web Application Firewall rules blocking common SQL injection payloads; restrict the GisLab application database user account to minimal required privileges (remove INSERT, UPDATE, DELETE if possible). Within 30 days: Apply vendor-released patch to all affected GisLab instances immediately upon availability, or execute complete upgrade to a patched version; conduct forensic review of database access logs for exploitation indicators; perform clean database restore from pre-vulnerability backup if compromise is identified.

GisLab Laboratory Management System CVE-2026-8297

EUVD-2026-45201 CRITICAL

SQL Injection (CWE-89)

2026-07-17 TR-CERT

GHSA-4339-8x9g-3w7v

SQLi Gislab Laboratory Management System

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) yields full database read/write and potential DoS, so C:H/I:H/A:H, matching the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:45 vuln.today

CVE Published

Jul 17, 2026 - 15:50 cve.org

CRITICAL 9.8

DescriptionNVD

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection.

This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.

AnalysisAI

SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a classic SQL injection (CWE-89) in a laboratory information management system (LIMS) built by the Turkish vendor Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. Such systems manage sample tracking, test results, and patient/client records against a relational database backend. The root cause is failure to parameterize or sanitize user-supplied input before concatenating it into SQL statements, allowing an attacker to break out of the intended query context and execute attacker-controlled SQL. The single CPE (cpe:2.3:a:gis_informatics_...:gislab_laboratory_management_system:*) uses a wildcard version, so it does not by itself delimit the affected range; the vendor version range comes from the advisory text.

RemediationAI

No specific vendor-released fix version was included in the available data (No vendor-released patch identified at time of analysis); consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0573 and contact the vendor directly for a patched build superseding 08072026. In the interim, place the application behind a web application firewall with SQL injection signatures tuned to the affected endpoints, restrict network access to the management interface to trusted internal networks or VPN rather than exposing it to the internet, and enforce least-privilege database accounts (no DBA/superuser rights for the application login) to limit the blast radius of a successful injection. Enabling query logging and monitoring for anomalous SQL patterns aids detection; note that WAF rules can be bypassed by sophisticated payloads and may cause false positives, so they are a stopgap, not a substitute for the vendor patch.