CVE Intelligence
Analysis AI-assisted

CVE-2025-10970: Kolay Software Talentics Blind SQL Injection

CVE-2025-10970 describes a blind SQL injection (CWE-89) in Talentics, a product from Kolay Software Inc. The CNA, USOM, assigned a CVSS 3.1 score of 9.8 (critical) with a network, low-complexity, no-privilege, no-interaction vector. The record lists no affected version entries, no fix, no KEV listing, and no vendor response.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-10970 is a blind SQL injection weakness (CWE-89) affecting Talentics, a product from Kolay Software Inc. The CNA listed in the record is USOM, and the description states that the vendor did not respond to early contact about the disclosure.

Impact

According to the CVSS 3.1 vector recorded by the CNA, the score reflects high impact on confidentiality, integrity and availability. In general terms, a SQL injection flaw can allow data in the back-end database to be read or changed, depending on how the application is built and configured. The actual impact in any given deployment is unknown from the record.

Affected products and versions

The description states that the issue affects Talentics through 20022026. This string is reproduced as written and does not clearly map to a standard version scheme. The structured affected list is empty, so no verified version range is available. Confirm the exposure of your installations with the vendor or with the cited national advisories.

Exploitation status

No confirmed exploitation appears in the sources consulted. The entry is not listed in the CISA KEV catalog. The EPSS probability recorded is 0.00315, with a percentile of 0.22648.

Remediation and mitigation

  • The record lists no fix. The absence of a listed fix does not confirm that none exists.
  • Contact Kolay Software for an update, advisory or guidance on the affected releases.
  • Until a fix is verified, limit network exposure of the application, restrict access to trusted users, and consider web application firewall rules as a temporary compensating control.
  • Teams maintaining custom integrations should rely on parameterized queries and strict input validation.

Detection guidance

  • Review web application and database logs for unusual query behavior, such as repeated requests to the same parameters with inconsistent responses or timing anomalies.
  • Monitor WAF alerts for SQL-related signatures and triage them promptly.
  • Keep log retention long enough to support investigation of past activity.

Limitations of the available information

  • The affected list is empty and the version string is not a standard version reference.
  • The record contains no fix, no vendor statement and no technical details beyond the classification.
  • The EPSS date recorded is 2026-10-13, which should be validated against the data source before use.
  • Sources consulted: NVD record, CVE Record, USOM notice and Siber Güvenlik notice.

Frequently asked questions

What is CVE-2025-10970?

It is a blind SQL injection weakness (CWE-89) in Talentics from Kolay Software Inc., scored 9.8 (critical) under CVSS 3.1 by the CNA USOM.

Is there a fix or known exploitation?

The record lists no fix and no KEV listing. No confirmed exploitation appears in the sources consulted, so check the vendor and national advisories for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.