CVE-2026-12718CWE-89sql-injection
CVE-2026-12718
Critical · published September 22, 2026
What it is
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection.
This issue affects KarelIPS: through 22092026.
NOTE: The vendor was contacted and it was learned that the product is not supported.
The record
Technical detail
- CVSS v3.1
- 9.8 · CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00321 · 23.9th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2026-09-22T18:17Z
References (1)
EPSS history
Timeline