{"id":"CVE-2026-74993","kind":"vulnerability","aliases":["CVE-2026-74993"],"related":[],"title":"Starnet Inventory Tracking Application: SQL injection lets attackers read database data","description":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection.\n\nThis issue affects Inventory Tracking Application: through 2026-10-16.","summary":"SQL injection (CWE-89) in Starnet Computer and Network Systems' Inventory Tracking Application, versions through 2026-10-16. The CNA (USOM) rates it network-reachable, no login needed, with high impact on confidentiality only, so an attacker could read the database. The vulnerable input and any fixed release are not published.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Inventory Tracking Application","fixed":[],"affected":"through 2026-10-16","ecosystem":"vendor"}],"ecosystems":[],"tags":["inventory-tracking","other","starnet"],"not_affected_if":[],"how_to_check":"unknown: the NVD entry gives only a date-based range (through 2026-10-16) and no vulnerable parameter. If you run Starnet's Inventory Tracking Application, check the build date with the vendor and ask Starnet for a fixed release.","fix":null,"status":"open","published_at":"2026-11-02T14:17:37+00:00","first_seen_at":"2026-11-02T14:23:24+00:00","triaged_at":"2026-11-02T14:24:50+00:00","updated_at":"2026-11-02T14:26:40+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-02T14:24:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Starnet Inventory Tracking Application: SQL injection lets attackers read or change data","impact":"high","summary":"The Starnet Computer and Network Systems Inventory Tracking Application fails to neutralize special characters in SQL commands, so input can alter database queries. An attacker can likely read or modify the inventory database; the sources do not say which versions or inputs are affected.","audience":"businesses","category":"other","nicknames":[],"who_cares":["inventory-tracking","starnet"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or changes inventory database contents via injected SQL","analyst_note":"Check the NVD entry and the vendor page for affected versions, the vulnerable input, and any fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000599,"input_tokens":4114,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor page for affected versions, the vulnerable input, and any fixed release.","search":"'-10':42B,111C '-16':43B,112C '-2026':13A,16A '-74993':14A,17A '-89':29B '2026':41B,110C 'affect':105C 'allow':100C 'applic':4A,38B,99C,108C 'application':20A 'attack':8A,63B 'cna':45B 'command':87C 'comput':32B,93C 'confidenti':59B 'could':64B 'cve':12A,15A 'cwe':28B 'data':11A 'databas':10A,67B 'element':82C 'fix':73B 'high':56B 'impact':57B 'improp':78C 'inject':6A,27B,89C,102C 'input':70B 'inventori':2A,22B,36B,97C,106C 'inventory':18A 'inventory-track':21B 'issu':104C 'let':7A 'login':53B 'need':54B 'network':34B,50B,95C 'network-reach':49B 'neutral':79C 'publish':77B 'rate':47B 'reachabl':51B 'read':9A,65B 'releas':74B 'special':81C 'sql':5A,26B,86C,88C,101C 'starnet':1A,25B,31B,92C 'system':35B,96C 'track':3A,23B,37B,98C,107C 'tracking':19A 'use':83C 'usom':46B 'version':39B 'vulner':69B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running Starnet Computer and Network Systems' Inventory Tracking Application with a build dated 2026-10-16 or earlier. The CVSS vector says it is reachable over the network with no login, so internet-exposed instances are most at risk. Anyone not using this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["inventorytrackingapplication","trackingapplication"],"ptokens":["application","inventory","tracking"],"labels":["high","inventorytracking","other","starnet"],"first_public_at":"2026-11-02T14:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74993","severity":null,"published_at":"2026-11-02T14:17:37+00:00","modified_at":"2026-11-02T14:17:37+00:00","first_seen_at":"2026-11-02T14:23:24+00:00","fetched_at":"2026-11-02T14:23:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-74993:1375","url":null,"severity":null,"published_at":"2026-11-02T14:26:40+00:00","modified_at":"2026-11-02T14:26:40+00:00","first_seen_at":"2026-11-02T14:26:40+00:00","fetched_at":"2026-11-02T14:26:40+00:00","note":"NVD record (CNA USOM) read via API: SQLi CWE-89, affected 'through 2026-10-16' (date-versioned), CVSS vector is C:H/I:N/A:N, i.e. data read, not modify. USOM advisory TR-26-1441 would not render; no vendor page, no fix, no vulnerable input found. Not exploited as far as sources say."}],"documents":[{"id":52299,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74993","title":"NVD: CVE-2026-74993","kind":"advisory","source":"analyst","publisher":null,"text":"Improper neutralization of special elements used in an SQL command (SQL injection, CWE-89) in Starnet Computer and Network Systems Inventory Tracking Application. Affects versions through 2026-10-16 (date-based version). CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, assigned by USOM (iletisim@usom.gov.tr). Reference: https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1441. Status: Received, no fix listed.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}