EUVD-2026-42965
GHSA-r958-fxrc-p879
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MobilMen 20T endpoint over network
-
DeliverySubmit crafted input to vulnerable parameter
-
ExploitBreak out of SQL query context
-
ExecutionExecute injected SQL on database
-
ImpactDump or modify pricing/transaction/customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation over the network against MobilMen 20T versions v3 through 10072026, requiring no authentication and no user interaction. Exploitation is limited primarily by reachability: the attacker must have network access to the vulnerable application endpoint, so deployments confined to an internal LAN or behind a VPN/firewall are materially harder to reach than internet-exposed instances. The exact vulnerable parameter/endpoint is not disclosed in the available data, and the product's limited/regional deployment further constrains realistic targeting. |
| Impact | Signals partly align and partly conflict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes an unauthenticated, low-complexity, network-reachable attack with total confidentiality, integrity and availability impact - the reason for the 9.8 score. SQL injection is inherently automatable and reliably weaponizable, which supports treating it as high priority where the product is exposed. However, counterbalancing signals lower the practical urgency: there is no EPSS score provided, no KEV listing (no confirmed active exploitation), and no public exploit identified. MobilMen 20T is a niche, regionally-deployed product, so exploitation is likely to be targeted rather than internet-wide mass scanning. Net: genuinely severe for any organization actually running MobilMen 20T with network exposure, but low real-world blast radius given limited deployment footprint. Note the AV:N rating assumes the application is network-reachable; retail/POS backends are frequently on internal LANs, which would reduce exposure - verify actual network placement. |
| Exploit ScenarioDerived | An attacker who can reach the MobilMen 20T application over the network submits a crafted value into a vulnerable parameter (e.g., a login, search, or product-lookup field), breaking out of the intended SQL query to dump the entire database - pricing, transaction and customer data - or to modify records. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required and the attack is easily scripted; no public proof-of-concept has been identified, so exploitation would require an attacker to develop the injection independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
SQL injection in Adam Retail Automation's MobilMen 20T retail-automation software (versions v3 through build 10072026) lets remote attackers inject arbitrary SQL through improperly neutralized input, yielding full read/write access to the backing database. Rated CVSS 9.8 by TR-CERT with an unauthenticated network-reachable vector, though no public exploit has been identified and it is not on CISA KEV. The vendor was contacted but did not respond, so no fix is available.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted early but did not respond, so no fixed version number exists to cite. In the absence of a patch, apply compensating controls: place MobilMen 20T behind a WAF with SQL-injection signatures to filter malicious input (accepting that WAF rules can be bypassed and may need tuning to avoid breaking legitimate POS transactions); restrict network access to the application so only trusted POS terminals and management hosts can reach it, ideally removing any internet exposure and segmenting it onto an isolated VLAN (trade-off: remote/branch access must be routed through VPN); enforce least-privilege on the application's database account so a successful injection cannot escalate beyond the minimum required tables (trade-off: requires testing to confirm the app still functions); and enable database query logging/monitoring to detect anomalous statements. Consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0526 and, given the unresponsive vendor, evaluate migrating off the product if a maintained alternative exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MobilMen 20T is a retail/point-of-sale automation product from the Turkish vendor Adam Retail Automation Ltd. (CPE cpe:2.3:a:adam_retail_automation_ltd.:mobilmen_20t). The flaw is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue: user-controlled input is concatenated into SQL statements without parameterization or proper escaping, so crafted values break out of the intended query context and are executed by the database engine. Because retail automation platforms typically store pricing, inventory, transaction and customer/payment records, the underlying database is a high-value target.
Know when Mobilmen 20T gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated SQL injection over the network (AV:N/AC:L/PR:N/UI:N) grants full database read/write, so C:H/I:H/A:H; scope unchanged as impact stays within the database system.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection.
This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Critical SQL injection vulnerability in Adam Retail Automation's MobilMen 20T retail-automation platform (versions v3 through build 10072026) enables unauthenticated remote attackers to achieve full read/write access to the operational database, exposing customer payment data, inventory records, and transaction history. No vendor patch exists after contact attempts failed, leaving organizations operating this software in a persistent, directly exploitable state. This represents immediate risk to financial data integrity, regulatory compliance (PCI-DSS, state privacy laws), and business continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement network-layer access controls restricting MobilMen 20T to internal VPN/firewall-protected access only; (2) Deploy Web Application Firewall with SQL injection signatures to filter malicious input; (3) Configure database-level query logging on all tables and trigger alerts for SELECT/INSERT/UPDATE/DELETE operations from unexpected accounts; (4) Apply least-privilege database credentials (read-only for application service account where operationally feasible); (5) Isolate affected systems from internet-connected payment networks; (6) Schedule weekly database integrity audits and access log reviews; (7) Establish incident response procedures for rapid database restoration from clean backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB