SQL Injection Vulnerability in Xpoda Studio by Xpoda Türkiye Information Technology Inc.
CVE-2025-6830

9.8CRITICAL

Key Information:

Vendor

Xpoda Türkiye Information Technology Inc.

Status
Password Module
Vendor
CVE Published:
9 February 2026

What is CVE-2025-6830?

The vulnerability in Xpoda Studio from Xpoda Türkiye Information Technology Inc. allows attackers to exploit improper handling of user input, leading to potential SQL injection attacks. This flaw can enable unauthorized access to the underlying database, allowing attackers to extract sensitive data or manipulate database queries. All versions of Xpoda Studio up to 09022026 are impacted, presenting serious risks if not addressed. Despite attempts to notify the vendor, no response has been received regarding this critical security issue.

Affected Version(s)

Password Module 0 <= 11022026

References

https://www.usom.gov.tr/bildirim/tr-26-0020
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hasan Yasin YAŞAR
Yusuf Melih DAŞKIRAN
.