CVE-2026-18630: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software

This vulnerability (CWE-89) in Talassoft Industrial Management Software allows an attacker with low privileges to perform SQL injection due to improper neutralization of special elements in SQL commands. The affected versions range from V.4 before V.16. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary SQL commands, leading to unauthorized data access, modification, or deletion, and potentially full system compromise. The CVSS vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected software to trusted users only and monitor for suspicious activity related to SQL injection attempts.