CVE-2026-2395

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection.

This issue affects No Code Platform: from 4.1.3 before 4.1.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-239505.9node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling CVE-2026-239515.5SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exa CVE-2026-239527.5ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointe CVE-2026-239538.7Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a CVE-2026-239548.7Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with CVE-2026-239554.2EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings w CVE-2026-239567.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4 CVE-2026-239577.5seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, CVE-2026-239589.8Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as CVE-2026-239594.9CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in t CVE-2026-23964.4The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up CVE-2026-239605.4Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.6.17 an