CVE-2026-2395

SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

State: Published
Severity: 9.8 Critical
Published: Jul 22, 2026
Updated: Jul 30, 2026
Reserved: Feb 12, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection.

This issue affects No Code Platform: from 4.1.3 before 4.1.4.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	TR-CERT

Weaknesses

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')

Affected Products

Product	Versions
No Code PlatformXpoda Türkiye Informatics Technology Inc.	4.1.3 to before 4.1.4Affected

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.