CVE-2025-4686

HIGH

Kodmatic Online Exam and Assessment through 30012026 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-4686. PoCs published by sahici.

AI-analyzed exploit summary The repository contains only a README.md with a placeholder message indicating an official announcement is pending. No exploit code or technical details are provided.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection. This issue affects Online Exam and Assessment: through 30012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

nomisec STUB
by sahici · poc
https://github.com/sahici/CVE-2025-4686

The repository contains only a README.md with a placeholder message indicating an official announcement is pending. No exploit code or technical details are provided.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unspecified
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource government-resource broken-link
https://www.usom.gov.tr/bildirim/tr-26-0010

Scores

CVSS v3 8.6
EPSS 0.0030
EPSS Percentile 21.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co./Online Exam and Assessment < 30012026
Published Jan 30, 2026
Tracked Since Feb 18, 2026