CVE WatchAug 6, 2026

CVE-2026-5134

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology L

CVSS

9.8

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 6, 2026 · Last modified: Aug 6, 2026 · CWE-89

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Official references

siberguvenlik.gov.trhttps://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0771

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-664479.3 CRI

—

———Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.7h CVE-2026-655698.5 HIG

—

———Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.7h CVE-2026-655478.5 HIG

—

———Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.7h CVE-2026-655469.3 CRI

—

———Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.8h CVE-2026-655209.3 CRI

—

———Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.7h CVE-2026-655089.3 CRI

—

———Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.7h