9.8crit
CVE-2025-6830
SQLi in Xpoda Türkiye Information Technology's Password Module
Published 8 mo ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 40%
Public exploits
0
none known
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module allows SQL Injection.
This issue affects Password Module: through 11022026.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 8 mo ago
Exploit prediction (EPSS)
0.46% probability of exploitation in the next 30 days, higher than 40% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Xpoda Türkiye Information Technology Inc. Password Module
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- usom.gov.tr /bildirim/tr-26-0020 · government-resource, broken-link
- siberguvenlik.gov.tr /guvenlik-bildirimleri/detay/tr-26-0020 · government-resource
Sources
- CVE List: CVE-2025-6830
- NVD: CVE-2025-6830
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.