by Kastro
Paper/Archive/CVE-2025-10610

CVE-2025-10610

SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure — SQLi in SFS Winsure

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 31.4.314 × 206.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreign Trade Inc. Winsure allows Blind SQL Injection. This issue affects Winsure: through Version dated 21.08.2025.

Affected

ProductAffectedFixed inSource
Winsure≤ Version dated 21.08.2025–CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0337refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0337