{"id":"CVE-2026-105321","kind":"vulnerability","aliases":["CVE-2026-105321"],"related":[],"title":"Kobikom PBX: SQL injection flaw before KobiPBX-FOP3-SEC-r1","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection.\n\nThis issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.","summary":"Kobikom's KobiPBX product has an SQL injection flaw, where crafted input is passed unchecked into database queries. The sources do not say what an attacker can read or change beyond that.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kobikom","kobipbx","other","pbx","telephony"],"not_affected_if":["already-on-kobipbx-fop3-sec-r1-or-later"],"how_to_check":"- Check whether you run KobiPBX and which build it is; the affected range is before `KobiPBX-FOP3-SEC-r1`","fix":"- KobiPBX: move to `KobiPBX-FOP3-SEC-r1` or later","status":"open","published_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","triaged_at":"2026-11-05T14:40:26+00:00","updated_at":"2026-11-05T14:40:26+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-05T14:40:26Z","model":"claude-haiku-5-5","output":{"fix":"- KobiPBX: move to `KobiPBX-FOP3-SEC-r1` or later","reach":"unknown","title":"Kobikom PBX: SQL injection flaw before KobiPBX-FOP3-SEC-r1","impact":"high","summary":"Kobikom's KobiPBX product has an SQL injection flaw, where crafted input is passed unchecked into database queries. The sources do not say what an attacker can read or change beyond that.","audience":"businesses","category":"other","nicknames":[],"who_cares":["kobikom","kobipbx","telephony","pbx"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Database contents readable or changed through injected SQL queries","analyst_note":"Confirm the attack vector, whether authentication is required, and the exact vendor advisory for KobiPBX-FOP3-SEC-r1 at https://nvd.nist.gov/vuln/detail/CVE-2026-105321.","how_to_check":"- Check whether you run KobiPBX and which build it is; the affected range is before `KobiPBX-FOP3-SEC-r1`\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["already-on-kobipbx-fop3-sec-r1-or-later"],"who_is_affected":"Organizations running Kobikom KobiPBX builds older than KobiPBX-FOP3-SEC-r1. The sources do not say which features or configurations make an installation reachable, so unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4225,"output_tokens":579,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105321':14A,17A '-2026':13A,16A 'affect':80C 'allow':75C 'attack':48B 'beyond':53B 'chang':52B 'command':63C 'craft':33B 'cve':12A,15A 'databas':39B 'element':58C 'flaw':5A,31B 'fop3':9A,85C 'improp':54C 'inc':73C 'informat':71C 'inject':4A,30B,65C,77C 'input':34B 'issu':79C 'kobikom':1A,18B,23B,68C,74C,81C 'kobipbx':8A,19B,25B,84C 'kobipbx-fop3-sec-r1':7A,83C 'neutral':55C 'pass':36B 'pbx':2A,21B 'product':26B 'queri':40B 'r1':11A,87C 'read':50B 'say':45B 'sec':10A,86C 'servic':72C 'sourc':42B 'special':57C 'sql':3A,29B,62C,64C,76C 'telecommun':69C 'telephoni':22B 'uncheck':37B 'use':59C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Kobikom KobiPBX builds older than KobiPBX-FOP3-SEC-r1. The sources do not say which features or configurations make an installation reachable, so unknown beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kobikom","kobipbx","other","pbx","telephony"],"campaign_type":null,"first_public_at":"2026-11-05T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105321","severity":null,"published_at":"2026-11-05T14:16:59+00:00","modified_at":"2026-11-05T14:16:59+00:00","first_seen_at":"2026-11-05T14:39:16+00:00","fetched_at":"2026-11-05T14:39:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}