CVE-2025-11253 | Improper Neutralization of Special Elements used in an SQL C… | CVSS 9.8 CRITICAL

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000.

Metadata

CVE ID: CVE-2025-11253
State: PUBLISHED
Assigner: TR-CERT
Reserved: 2025-10-03 11:53 UTC
Published: 2025-10-24 08:32 UTC
Last updated: 2026-06-04 19:31 UTC
Primary CWE: CWE-89
CWE-89 Improper Neutralization of Special Elements used in a…
Vendor / Product: Aksis Technology Inc. / Netty ERP
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Aksis Technology Inc.	Netty ERP	—	0 < V.1.1000

Weakness (CWE)

CWE	Source	Description
CWE-89	cna	CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)