CVE-2026-2395

CriticalCVSS 9.8

Published: 22/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

SQL injection vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows an attacker to manipulate database queries due to improper neutralization of special elements in an SQL command. The issue affects versions from 4.1.3 before 4.1.4.

Risk Assessment

An attacker can gain unauthorized access to data, modify or delete it, leading to a breach of confidentiality and integrity of the system.

Recommendation

It is recommended to immediately upgrade to version 4.1.4 or later, which includes a fix for the vulnerability.

Original NVD description (English source)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.