CVE-2026-12718
Received Received - Intake

Blind SQL Injection in KarelIPS

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-12718
EUVD
EUVD-2026-84397

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
karel_electronic_industry_and_trade_inc karelips to 22092026 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in KarelIPS software from Karel Electronic Industry and Trade Inc. It allows attackers to manipulate SQL commands by injecting malicious input, potentially accessing or modifying database contents without authorization.

Detection Guidance

This vulnerability is a Blind SQL Injection in KarelIPS. Detection requires testing for SQL injection flaws in web applications. Use tools like SQLmap to test parameters for injection points with commands such as: sqlmap -u "http://target-url/endpoint?param=value" --batch --dbs. Monitor application responses for errors or delays indicating potential SQL injection.

Impact Analysis

An attacker could exploit this to read sensitive data, alter or delete database records, or execute unauthorized administrative operations. This could lead to data breaches, system compromise, or service disruption if the software is internet-facing.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR (data protection), HIPAA (health information), or other regulations by enabling unauthorized access to sensitive data. Organizations using this software may face legal penalties or audit failures.

Mitigation Strategies

Since KarelIPS is no longer supported by the vendor, discontinue use of the product immediately. If continued use is unavoidable, isolate the system from critical networks and implement strict access controls. Monitor network traffic for suspicious SQL queries and apply network-level protections like WAF rules to block injection attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12718. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart