Akin Software Computer Import Export Industry And Trade Ltd
Monthly
Path traversal in AKINSOFT Wolvox9 ERP's KontrolPanel.exe component exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized file path inputs. Affected deployments span versions s26.02.17 through s26.02.21, with a confirmed fix in version 26.02.22 per TR-CERT advisory TR-26-0851. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS profile (7.5 High, C:H) means exploitation requires no specialized knowledge or credentials - any attacker with network reach to the service can trivially exfiltrate sensitive ERP data.
Missing authentication in AKIN Software's CafePlus versions 12.05.03 through 12.05.04 allows adjacent-network attackers to access privileged functionality without credentials. The flaw enables full compromise of confidentiality, integrity, and availability over an adjacent network vector, with no public exploit identified at time of analysis. Reported by Turkey's national CERT (TR-CERT), the issue stems from critical functions lacking proper ACL enforcement.
Reflected XSS in AKIN Software E-Commerce (all versions before 1.25.01.06) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation requiring no authentication, with a scope change indicating script execution in the browser context outside the originating document. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.
Path traversal in AKINSOFT Wolvox9 ERP's KontrolPanel.exe component exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized file path inputs. Affected deployments span versions s26.02.17 through s26.02.21, with a confirmed fix in version 26.02.22 per TR-CERT advisory TR-26-0851. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS profile (7.5 High, C:H) means exploitation requires no specialized knowledge or credentials - any attacker with network reach to the service can trivially exfiltrate sensitive ERP data.
Missing authentication in AKIN Software's CafePlus versions 12.05.03 through 12.05.04 allows adjacent-network attackers to access privileged functionality without credentials. The flaw enables full compromise of confidentiality, integrity, and availability over an adjacent network vector, with no public exploit identified at time of analysis. Reported by Turkey's national CERT (TR-CERT), the issue stems from critical functions lacking proper ACL enforcement.
Reflected XSS in AKIN Software E-Commerce (all versions before 1.25.01.06) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation requiring no authentication, with a scope change indicating script execution in the browser context outside the originating document. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.