What is the CVSS score of EUVD-2026-48284?

EUVD-2026-48284 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

BizimHesap Accounting EUVD-2026-48284

| CVE-2026-8287 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-23 iletisim@usom.gov.tr

GHSA-wvm9-825c-5gjg

Denial Of Service

4.3

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

4.3 MEDIUM

Network-reachable web app, low complexity; PR:L required per description; availability-only impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 14:34 vuln.today

DescriptionCVE.org

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation.

This issue affects Online Pre-Accounting Software: through 17072026.

AnalysisAI

Unthrottled resource allocation in BizimHesap Online Pre-Accounting Software allows authenticated low-privileged network attackers to exhaust system resources, causing a denial of service condition. All versions through 17072026 are confirmed affected. Reported by Turkey's National Cyber Incident Response Center (USOM), no public exploit code or active exploitation has been identified at time of analysis. The vulnerability carries a CVSS 4.3 score, reflecting a low-availability-impact DoS limited to authenticated users.

Technical ContextAI

CWE-770 (Allocation of Resources Without Limits or Throttling) describes a failure to impose caps on consumed resources such as memory, connections, file handles, or processing time. In the context of an online pre-accounting platform, this commonly manifests as missing rate limiting on API endpoints, bulk data processing operations, or report generation requests, allowing an authenticated user to trigger unbounded resource consumption. The affected product is BizimHesap Information Systems' Online Pre-Accounting Software, a Turkish-market cloud or web-hosted accounting solution. No CPE string was provided, but the version designator '17072026' follows a date-based naming convention (DD/MM/YYYY), indicating the vulnerability affects all releases up to the July 17, 2026 build. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L confirms the flaw is remotely exploitable by any low-privilege account holder with no complexity barrier.

RemediationAI

Consult the vendor advisory published by Turkey's National Cybersecurity Directorate at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0620 for any vendor-released patch targeting the resource throttling deficiency. No explicit patched version number was included in available intelligence - patch availability per vendor advisory is noted but an exact fix version is not independently confirmed from provided data. As a compensating control pending a patch, administrators should enforce per-user request rate limits at the web application firewall or reverse proxy layer, monitor for abnormal session activity or high-frequency API calls by low-privilege accounts, and restrict the number of concurrent authenticated sessions per user. Disabling or rate-limiting bulk-processing or report-generation endpoints can reduce the attack surface with minimal operational impact for standard accounting workflows. Note: authentication is already required (PR:L), so disabling anonymous access does not add further protection.