PT-2026-56410 · Unknown · Mediküm Web

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-8307

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mediküm Web versions prior to 08072026

Description Mediküm Web contains an SQL injection flaw resulting from improper neutralization of special elements used in SQL commands. This occurs due to inadequate input validation or parameterization, which allows attacker-controlled input to be interpreted as part of backend SQL queries. An unauthenticated remote attacker can exploit this over HTTP by sending crafted requests to affected endpoints and parameters. Successful exploitation may lead to full database compromise, including data exfiltration, data modification, authentication bypass, and potential remote code execution depending on database privileges and server configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-8307

Affected Products

Mediküm Web

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-8307 · Security Note
• https://twitter.com/UpwindMDR/status/2074875523369463910 · Twitter Post
• https://twitter.com/OrizonCyber/status/2074848491482841096 · Twitter Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0518 · Note