CVE-2025-6830 SQLi in Xpoda Türkiye Information Technology's Password Module

CriticalCVSS 9.8 EPSS 0.46%

Published: 2026-02-09 13:18
Updated: 2026-06-17 13:02
Exploit status: No public exploit known

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection.

This issue affects Password Module: through 11022026.

Affected products

Product	Affected versions	Fixed in
Xpoda Türkiye Information Technology Inc. Password Module	<= 11022026	No fix listed

References

www.usom.gov.tr broken-link government-resource
siberguvenlik.gov.tr government-resource

CVSS v3.1

9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.1 9.8 · tr-cert
v3.1 9.8 · iletisim@usom.gov.tr

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.46% (percentile 40.5)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.