CVE-2026-18782

CRITICAL9.8

Published 2026-09-30 · Source iletisim@usom.gov.tr

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-89

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-103395
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
2026-09-30 · score 9.8
CVE-2026-82307
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
2026-09-30 · score 9.8
CVE-2026-97274
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
2026-09-30 · score 9.8
CVE-2026-97248
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
2026-09-30 · score 9.8
CVE-2026-96822
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
2026-09-30 · score 9.3