Search

Find a vulnerability

Search criteria

    4 vulnerabilities by İzometri IT Services Domestic and Foreign Trade Co. Ltd.

    CVE-2026-91844 (GCVE-0-2026-91844)

    Vulnerability from nvd – Published: 2026-10-08 13:42 – Updated: 2026-10-08 13:57
    VLAI
    Title
    Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip
    Summary
    Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.
    Severity
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:57 UTC
    CWE
    • CWE-434 - Unrestricted upload of file with dangerous type
    Assigner
    References
    Impacted products
    Date Public
    2026-10-08 13:36
    Credits
    Koray Danışma Tahsin Ünlütürk
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:57:15.354769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:24.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.6",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.6.\u003c/p\u003e"
            }
          ],
          "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17 Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted upload of file with dangerous type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:42:27.448Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution via Unrestricted File Upload in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-91844",
    "datePublished": "2026-10-08T13:42:27.448Z",
    "dateReserved": "2026-09-15T08:35:49.507Z",
    "dateUpdated": "2026-10-08T13:57:24.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89290 (GCVE-0-2026-89290)

    Vulnerability from nvd – Published: 2026-10-08 13:45 – Updated: 2026-10-08 13:57
    VLAI
    Title
    HTML Injection in İzometri Informatics' eimzamip
    Summary
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.
    Severity
    3.5 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:56 UTC
    CWE
    • CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
    Assigner
    References
    Impacted products
    Date Public
    2026-10-08 13:43
    Credits
    Koray Danışma Tahsin Ünlütürk
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:56:52.710818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:01.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.7",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.7.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:45:43.188Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "HTML Injection in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-89290",
    "datePublished": "2026-10-08T13:45:43.188Z",
    "dateReserved": "2026-09-11T12:22:23.701Z",
    "dateUpdated": "2026-10-08T13:57:01.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-89290 (GCVE-0-2026-89290)

    Vulnerability from cvelistv5 – Published: 2026-10-08 13:45 – Updated: 2026-10-08 13:57
    VLAI
    Title
    HTML Injection in İzometri Informatics' eimzamip
    Summary
    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.
    Severity
    3.5 (Low)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:56 UTC
    CWE
    • CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
    Assigner
    References
    Impacted products
    Date Public
    2026-10-08 13:43
    Credits
    Koray Danışma Tahsin Ünlütürk
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:56:52.710818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:01.956Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.7",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.7.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.7."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:45:43.188Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "HTML Injection in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-89290",
    "datePublished": "2026-10-08T13:45:43.188Z",
    "dateReserved": "2026-09-11T12:22:23.701Z",
    "dateUpdated": "2026-10-08T13:57:01.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-91844 (GCVE-0-2026-91844)

    Vulnerability from cvelistv5 – Published: 2026-10-08 13:42 – Updated: 2026-10-08 13:57
    VLAI
    Title
    Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip
    Summary
    Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6.
    Severity
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-08 13:57 UTC
    CWE
    • CWE-434 - Unrestricted upload of file with dangerous type
    Assigner
    References
    Impacted products
    Date Public
    2026-10-08 13:36
    Credits
    Koray Danışma Tahsin Ünlütürk
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91844",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T13:57:15.354769Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T13:57:24.257Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "eimzamip",
          "vendor": "\u0130zometri IT Services Domestic and Foreign Trade Co. Ltd.",
          "versions": [
            {
              "lessThan": "v1.6.6",
              "status": "affected",
              "version": "v1.6.4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Koray Dan\u0131\u015fma"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Tahsin \u00dcnl\u00fct\u00fcrk"
        }
      ],
      "datePublic": "2026-10-08T13:36:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\u003cp\u003eThis issue affects eimzamip: from v1.6.4 before v1.6.6.\u003c/p\u003e"
            }
          ],
          "value": "Unrestricted upload of file with dangerous type vulnerability in \u0130zometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-17",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-17 Using Malicious Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted upload of file with dangerous type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T13:42:27.448Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275"
        }
      ],
      "source": {
        "advisory": "TR-26-1275",
        "defect": [
          "TR-26-1275"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution via Unrestricted File Upload in \u0130zometri Informatics\u0027 eimzamip",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2026-91844",
    "datePublished": "2026-10-08T13:42:27.448Z",
    "dateReserved": "2026-09-15T08:35:49.507Z",
    "dateUpdated": "2026-10-08T13:57:24.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}