Vulnerability · Published Jul 22, 2026 · Assigned by TR-CERT
CVE-2026-2395SQLi in Xpoda Türkiye Informatics Technology's No Code Platform
Critical 9.8
In plain English
A critical-severity SQL injection in No Code Platform from Xpoda Türkiye Informatics Technology Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xpoda Türkiye Informatics Technology Inc. | No Code Platform | 4.1.3 – before 4.1.4 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608 government-resource