CVE-2026-18630
HighCVSS 8.8Summary
SQL injection vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. due to improper neutralization of special elements in SQL commands. Affects versions from V.4 before V.16.
Risk Assessment
An attacker can inject malicious SQL code, potentially leading to unauthorized data access, modification, or deletion, and possibly full application compromise.
Recommendation
Immediately update the software to version V.16 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Talassoft Industrial Management Software
See all- CVE-2026-18780High
A Cross-Site Request Forgery (CSRF) vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows unauthorized actions to be performed on behalf of an authenticated user.
- CVE-2026-18771High
A missing authentication for critical function vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows authentication bypass and access to administrative functions without logging in.
- CVE-2026-18931Critical
Use of Hard-coded Credentials vulnerability in Talassoft Industrial Management Software allows retrieval of embedded sensitive data. Affects versions from V.4 before V.16.
Original NVD description (English source)
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.