CVE-2026-18210: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store

This vulnerability (CVE-2026-18210) is an SQL injection flaw classified under CWE-89 in the Products's Store software by TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company. It arises from improper neutralization of special elements used in SQL commands, allowing attackers to manipulate database queries. The affected versions are those before commit 030631b2. The vulnerability has a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database, leading to full compromise of data confidentiality, integrity, and availability within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable service to untrusted networks if possible.