No Code Platform
Monthly
SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.
SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.