What is the CVSS score of EUVD-2026-51156?

EUVD-2026-51156 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Traffic Analysis System are affected by EUVD-2026-51156?

UMAI Vision Traffic Analysis System versions 29-33 contain a critical SQL injection vulnerability allowing unauthenticated attackers to gain full database access.. A patch is available.

How to fix or mitigate EUVD-2026-51156?

Within 24 hours, identify all systems running UMAI Vision versions 29, 30, 31, 32, or 33 and review database access logs for suspicious SQL activity. Within 7 days, deploy the vendor patch to upgrade all affected production and non-production instances to version 34 or later. Within 30 days, conduct forensic analysis of database access logs to confirm no unauthorized data retrieval occurred, and audit database user roles to remove unnecessary privileges.

Traffic Analysis System EUVD-2026-51156

| CVE-2026-4978 CRITICAL

SQL Injection (CWE-89)

2026-07-30 TR-CERT

GHSA-c9qv-jc9j-fcr6

SQLi Traffic Analysis System

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (TR-CERT) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated SQL injection with no user interaction warrants AV:N/AC:L/PR:N/UI:N, and full database read/write/destruction supports C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:22 vuln.today

Patch available

Jul 30, 2026 - 16:03 EUVD

CVE Published

Jul 30, 2026 - 14:53 cve.org

CRITICAL 9.8

DescriptionNVD

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection.

This issue affects Traffic Analysis System: from 30 before 34.

AnalysisAI

SQL injection in UMAI Vision Traffic Analysis System (versions 29/30 up to but not including 34) lets remote unauthenticated attackers inject arbitrary SQL commands through unsanitized input, enabling full database compromise. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector, the flaw was reported by Turkey's national CERT (TR-CERT) and has a vendor patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected product is UMAI Vision's Traffic Analysis System (CPE cpe:2.3:a:umai_vision:traffic_analysis_system), a specialized traffic/video analytics platform typically deployed in transportation and municipal surveillance contexts. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input is concatenated into SQL queries without parameterization or proper escaping, so crafted input alters the intended query structure. Such flaws usually live in web-facing request handlers - login forms, search/filter parameters, or API endpoints - that build queries dynamically against the backing database.

RemediationAI

Upgrade UMAI Vision Traffic Analysis System to version 34 or later, which the vendor has released to remediate this issue (patch available per vendor advisory; consult the TR-CERT bulletin at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0703 for the exact fixed build). If immediate patching is not possible, restrict network reachability of the application to trusted management networks or a VPN to remove unauthenticated internet exposure, and deploy a WAF with SQL-injection signatures in front of the application to filter malicious payloads - noting that WAF filtering can be bypassed by determined attackers and may block legitimate requests containing SQL-like characters. Additionally, run the application's database account with least privilege to limit the blast radius of a successful injection.