CVE-2025-4686
Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 30, 2026
- Updated
- Jun 5, 2026
- Reserved
- May 14, 2025
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection.
This issue affects Online Exam and Assessment: through 30012026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H | TR-CERT |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Online Exam and AssessmentKodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. |
|
References
- https://www.usom.gov.tr/bildirim/tr-26-0010government-resourcebroken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0010government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.