Vulnerability · Published Jan 30, 2026 · Assigned by TR-CERT

CVE-2025-4686Time-Based Blind SQLi in Kodmatic Computer's Online Exam and Assessment

High 8.6

In plain English

A high-severity SQL injection in Online Exam and Assessment from Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam and Assessment: through 30012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co.	Online Exam and Assessment	0 – through 30012026

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

https://www.usom.gov.tr/bildirim/tr-26-0010 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0010 government-resource