by Kastro
Paper/Archive/CVE-2025-2812

CVE-2025-2812

Mydata Informatics Ticket Sales Automation — SQLi in Mydata Informatics' Ticket Sales Automation

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.0.420 × 208.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD.MM.YYYY).

Affected

ProductAffectedFixed inSource
Ticket Sales Automation< 03.04.2025 (DD.MM.YYYY)03.04.2025 (DD.MM.YYYY)CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0099writeupgithub.com/sahici/CVE-2025-2812refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0099