CVE-2026-18198

HighCVSS 8.8/10Last modified Sep 8, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection.

This issue affects GOLDENHORN ONEIT: before Göbeklitepe.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
TAC Information Services Internal and External Trade Inc.	GOLDENHORN ONEIT	< Göbeklitepe

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0990

Timeline

Published: Sep 4, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-181998.8Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote C CVE-2026-18206.4The Media Library Alt Text Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bvmalt_sc_div_update_a CVE-2026-182004.3The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, CVE-2026-182015.5Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an admini CVE-2026-182026.8The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, al CVE-2026-182036.5A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to CVE-2026-182056.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. CVE-2026-182063.7A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs wh CVE-2026-182076.5A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name in CVE-2026-182086.5A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access CVE-2026-182094.7A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs CVE-2026-18216.4The Microtango plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'restkey' parameter of the mt_reservation shortcode