CVE-2026-12718

CriticalCVSS 9.8/10Last modified Sep 22, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection.

This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
Karel Electronic Industry and Trade Inc.KarelIPS<= 22092026

References

Timeline

Published
Sep 22, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-12724.3IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to Security Misconfiguration vulnerability in the user access control panel.CVE-2026-127207.5The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticatedCVE-2026-1272025.3MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to wriCVE-2026-1272035.4AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace members to upload bloCVE-2026-1272047.5WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability that allows remote attacCVE-2026-1272065.3Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers toCVE-2026-1272075.4Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, inclCVE-2026-1272088.8datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by CVE-2026-127218.6The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statCVE-2026-127228.2Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows AuthenticationCVE-2026-127235.3The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated usersCVE-2026-1272356.1A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. Severa
CVE-2026-12718: Critical severity, CVSS 9.8 | Vulnix