CVE-2023-5806

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.

This issue affects Quality Management System: before v1.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Mergen Software	Quality Management System	< v1.2

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0040
https://www.usom.gov.tr/bildirim/tr-24-0040Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-24-0040Third Party Advisory

Timeline

Published: Jan 18, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-58079.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows CVE-2023-58086.5SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a CVE-2023-58094.8The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2023-58104.8A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the CVE-2023-58114.8A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/to CVE-2023-58128.8A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of CVE-2023-58138.8A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown func CVE-2023-58148.8A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of th CVE-2023-58159.8The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post M CVE-2023-58164.9The Code Explorer plugin for WordPress is vulnerable to arbitrary external file reading in all versions up to, and including, 1.4.5. This is CVE-2023-58175.4The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up t CVE-2023-58184.3The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to m