{"id":"CVE-2026-18782","published":"2026-09-30T15:22:30.177","lastModified":"2026-09-30T16:18:57.403","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.\n\nThis issue affects Trex MES: through 2026-09-29.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1225","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows for SQL injection, enabling an attacker to execute arbitrary commands through the SQL interface, leading to potential data theft, system compromise, and unauthorized access.","exploitability":"Exploitation is relatively straightforward given the SQL injection vector, requiring only the ability to inject malicious SQL commands through a command-line interface.","blast_radius":"If exploited, the impact could be severe, potentially leading to complete system compromise and data exfiltration, affecting all users and systems interacting with the Trex MES.","remediation":"Upgrade to Trex MES version 2026-09-30 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","rce","mes","patch","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:47.306Z"}}