Yordam Information Technology Consulting Training And Electronic Systems Industry And Trade Inc
Monthly
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.
Authentication bypass in Yordam Library Automation System versions 21.6 through 22.0 enables remote attackers to impersonate legitimate users and gain unauthorized administrative access by manipulating user identifiers in requests. Attackers who successfully exploit this vulnerability can achieve full system compromise including reading sensitive library records, modifying catalog data, and disrupting availability. The vulnerability requires user interaction (likely social engineering or malicious link), but no authentication, making it accessible to external threat actors. TR-CERT has published an advisory confirming the issue affects Turkish government and educational institutions using this library management platform.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.
Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.
Authentication bypass in Yordam Library Automation System versions 21.6 through 22.0 enables remote attackers to impersonate legitimate users and gain unauthorized administrative access by manipulating user identifiers in requests. Attackers who successfully exploit this vulnerability can achieve full system compromise including reading sensitive library records, modifying catalog data, and disrupting availability. The vulnerability requires user interaction (likely social engineering or malicious link), but no authentication, making it accessible to external threat actors. TR-CERT has published an advisory confirming the issue affects Turkish government and educational institutions using this library management platform.