Gislab Laboratory Management System
Monthly
Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote attackers to read arbitrary files from the server filesystem via crafted HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction, and no elevated privileges are required, with high confidentiality impact. The vulnerability was disclosed by TR-CERT under advisory TR-26-1063; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allows remote attackers to inject arbitrary SQL through unsanitized input, per the CVSS vector with no authentication or user interaction required. An attacker can read, modify, or delete laboratory database contents and potentially achieve full database compromise. Disclosed via TR-CERT advisory TR-26-1063; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authorization bypass in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows an authenticated low-privileged user to access confidential data belonging to other users by manipulating user-controlled identifier keys in requests. The flaw (CWE-639, IDOR class) exposes high-confidentiality data without requiring elevated privileges or user interaction, over the network. No public exploit or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Turkey's national CERT (TR-CERT) via advisory TR-26-0573.
Unauthenticated path traversal in GisLab Laboratory Management System (versions 1.4.03 through before 1.5) allows remote attackers to read arbitrary files from the server filesystem via crafted HTTP requests. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction, and no elevated privileges are required, with high confidentiality impact. The vulnerability was disclosed by TR-CERT under advisory TR-26-1063; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allows remote attackers to inject arbitrary SQL through unsanitized input, per the CVSS vector with no authentication or user interaction required. An attacker can read, modify, or delete laboratory database contents and potentially achieve full database compromise. Disclosed via TR-CERT advisory TR-26-1063; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Authorization bypass in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows an authenticated low-privileged user to access confidential data belonging to other users by manipulating user-controlled identifier keys in requests. The flaw (CWE-639, IDOR class) exposes high-confidentiality data without requiring elevated privileges or user interaction, over the network. No public exploit or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Turkey's national CERT (TR-CERT) via advisory TR-26-0573.