CVE Intelligence
Analysis AI-assisted

CVE-2025-5319: Emit DIGITA Efficiency Management System SQL Injection

CVE-2025-5319 is an SQL injection flaw (CWE-89) in the DIGITA Efficiency Management System from Emit Informatics and Communication Technologies Industry and Trade Ltd. Co., described as affecting versions through 03022026. The CNA-assigned CVSS 3.1 base score is 9.8 (critical), but the record contains no structured affected versions, fixes or CISA KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-5319 describes an SQL injection weakness (CWE-89) in the DIGITA Efficiency Management System, a product from Emit Informatics and Communication Technologies Industry and Trade Ltd. Co. The record was published on 2026-02-03, and the CNA listed is iletisim@usom.gov.tr. The vendor reportedly did not respond to early contact about the disclosure.

Impact

The CNA scored the issue CVSS 3.1 9.8 (critical). The vector string indicates network reachability, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.

  • SQL injection flaws generally allow input to alter database queries, which can expose or modify stored data.
  • The record does not describe the specific data or functions affected in this product.

Affected products and versions

  • Product: DIGITA Efficiency Management System.
  • Vendor: Emit Informatics and Communication Technologies Industry and Trade Ltd. Co.
  • Stated range: through 03022026.
  • The record contains no structured affected or fixed version data, so the exact boundaries of the range cannot be verified from the sources consulted.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. EPSS data is absent.

Remediation and mitigation

  • No official vendor fix is identified in the record. A missing fixed version does not mean no fix exists, so administrators should contact the vendor directly for an update or guidance.
  • Restrict network exposure of the application and its administrative interfaces until the vendor's position is clear.
  • Review whether the application's database accounts run with only the privileges they need.
  • Consult the national advisories linked below for any additional guidance from the issuing authority.

Detection guidance

  • Review web application and database logs for unusual input patterns, repeated database errors, or unexpected query behaviour.
  • Monitor for unexpected changes or bulk reads in tables used by the application.
  • Treat these indicators as a starting point and correlate them with your own asset inventory, since the record does not list specific indicators.

Limitations of the available information

  • The record gives only a range expressed as a date string and no structured version list.
  • No affected or fixed version data, vendor advisory or KEV entry was available in the record.
  • The source status is shown as Deferred, and the CVSS score comes from the CNA rather than an independent analysis in the record.
  • The specific affected component, parameter or deployment conditions are not described.

Frequently asked questions

What is CVE-2025-5319?

It is an SQL injection vulnerability (CWE-89) in the DIGITA Efficiency Management System from Emit Informatics and Communication Technologies Industry and Trade Ltd. Co.

Is this CVE listed in CISA KEV?

No. The record shows the KEV listing as false, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record states the issue affects the product through 03022026. No structured affected or fixed version data is provided, so the boundaries cannot be verified.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.