{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5134", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-03-30T10:11:27.574Z", "datePublished": "2026-08-06T13:31:45.358Z", "dateUpdated": "2026-08-06T14:42:41.239Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-06T13:31:45.358Z"}, "title": "SQLi in Loca Software's CMS", "datePublic": "2026-08-06T13:28:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "affected": [{"vendor": "Loca Software Informatics Technology Ltd. Co.", "product": "CMS", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "06082026", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.<p>This issue affects CMS: through 06082026.&nbsp;<span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Onur KARA", "type": "finder"}], "source": {"defect": ["TR-26-0771"], "advisory": "TR-26-0771", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T14:42:33.207183Z", "id": "CVE-2026-5134", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:42:41.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T14:42:33.207183Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T14:42:38.317Z"}}], "cna": {"title": "SQLi in Loca Software's CMS", "source": {"defect": ["TR-26-0771"], "advisory": "TR-26-0771", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Onur KARA"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Loca Software Informatics Technology Ltd. Co.", "product": "CMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "06082026"}], "defaultStatus": "unknown"}], "datePublic": "2026-08-06T13:28:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.<p>This issue affects CMS: through 06082026.&nbsp;<span>NOTE: The vendor was contacted early about this disclosure but did not respond in any way.</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-06T13:31:45.358Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5134", "state": "PUBLISHED", "dateUpdated": "2026-08-06T14:42:41.239Z", "dateReserved": "2026-03-30T10:11:27.574Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-08-06T13:31:45.358Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "CMS", "vendor": "Loca Software Informatics Technology Ltd. Co.", "versions": [{"lessThanOrEqual": "06082026", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\n\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-5134", "lastModified": "2026-08-06T16:16:44.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5134", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T14:42:33.207183Z", "version": "2.0.3"}}]}, "published": "2026-08-06T14:16:36.840", "references": [{"source": "[email protected]", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "[email protected]", "type": "Secondary"}]}

{"bugzilla": {"description": "Loca Software Informatics Technology Ltd. Co. CMS: CMS: Critical SQL Injection vulnerability", "id": "2512052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512052"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-89", "details": ["Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection.\nThis issue affects CMS: through 06082026.\u00a0NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", "A flaw was found in CMS. This vulnerability, known as SQL injection, allows a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. This can lead to unauthorized access to sensitive data, modification of database content, and disruption of service, resulting in a critical impact on confidentiality, integrity, and availability."], "name": "CVE-2026-5134", "public_date": "2026-08-06T13:31:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-5134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5134\nhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771"], "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,06082026]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "CMS", "source": "cna", "vendor": "Loca Software Informatics Technology Ltd. Co."}, "product": "cms", "vendor": "loca_software_informatics_technology"}], "created": "2026-08-06T16:30:04.468313+00:00", "updated": "2026-08-07T10:00:45.965765+00:00", "vendors": ["loca_software_informatics_technology", "loca_software_informatics_technology$PRODUCT$cms"]}