CVE Intelligence
Analysis AI-assisted

CVE-2025-8587: AKCE SKSPro SQL Injection Vulnerability

CVE-2025-8587 is an SQL injection flaw (CWE-89) in SKSPro from AKCE Software Technology R&D Industry and Trade Inc., described as affecting versions through 07012026. NVD scores it 9.8 (CVSS 3.1, Critical), while the CNA USOM lists 8.6. No KEV listing or confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-8587 describes an SQL injection weakness (CWE-89) in SKSPro, a product from AKCE Software Technology R&D Industry and Trade Inc. The record was published on 2026-02-02 by the CNA iletisim@usom.gov.tr and is tracked in the USOM advisory TR-26-0011 and the Turkish national cyber security notice.

Impact

  • The CVSS 3.1 vector recorded by NVD is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability.
  • SQL injection flaws can allow an attacker to read, change or delete data in the back-end database and may disrupt application availability (inference from the vector and the CWE class).
  • The CNA score of 8.6 (CVSS 3.1) is lower than the NVD score; the reason for the difference is not stated in the record.

Affected products and versions

  • Product listed in the record: Akceyazilim Skspro.
  • Versions listed in the record: ≤ 2026-07-01. The description also states the issue affects SKSPro through 07012026. The record does not reconcile these two notations, so the exact boundary should be confirmed with the vendor.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record contains no fixed version or patch reference. Whether a fix exists is unknown from the available data.
  • Contact the vendor or check the advisories linked above for an updated SKSPro release and apply it as soon as it is confirmed.
  • Until a fix is verified, reduce exposure: restrict access to the application to trusted networks, place a web application firewall in front of it, validate and constrain input on the server side, and run database accounts with least privilege.

Detection guidance

  • Review web server and application logs for unusual input patterns on SKSPro endpoints and for database error messages returned to clients.
  • Monitor database activity for unexpected queries, bulk data reads or schema changes originating from the application account.
  • Correlate alerts with authentication and access logs to identify unusual sources.

Limitations of the available information

  • The record does not identify the vulnerable component, parameter or endpoint.
  • No fixed version, vendor patch or vendor statement is included.
  • EPSS and SSVC data are absent, and the KEV entry is empty for this CVE.
  • The affected version range is expressed in two different formats.

Frequently asked questions

What type of vulnerability is CVE-2025-8587?

It is an SQL injection weakness classified as CWE-89, affecting AKCE SKSPro according to the record.

Is there a fixed version available?

The record lists no fixed version or patch. Check the vendor and the linked USOM advisory for updates.

Is this CVE known to be exploited in the wild?

It is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.