Key INFOREX 跨站脚本漏洞

Key INFOREX is a financial and banking management system developed by the Turkish company Key. The Key INFOREX version 2025 and earlier versions had a cross-site scripting vulnerability. This vulnerability stemmed from improper input during web page generation, which could allow cross-site...

Websitem 7070 Hazır Profesyonel Web Sitesi SQL注入漏洞

Websitem 7070 Ready-made Professional Website is a website construction kit provided by the Turkish company Websitem. Version 1.0 of Websitem 7070 Ready-made Professional Website contains a SQL injection vulnerability. This vulnerability stems from an authentication bypass in the login page of th...

Teknolist Okulistik 代码问题漏洞

Teknolist Okulistik is an online education platform owned by the Turkish company Teknolist. Versions of Teknolist Okulistik from 2012/02/20 onwards have code vulnerabilities related to server-side request forgery, which may lead to such attacks...

Dinibh Patrol Tracking System 安全漏洞

Dinibh Patrol Tracking System is an inspection management platform developed by the Turkish company Dinibh. The versions of Dinibh Patrol Tracking System 10022026 and earlier contained security vulnerabilities. These vulnerabilities stemmed from bypassing authorization using user control keys,...

Sarman Soft CMS 安全漏洞

Sarman Soft CMS is a content management system developed by the Turkish company Sarman Soft. Versions of Sarman Soft CMS prior to 10022026 contained security vulnerabilities. These vulnerabilities were due to redirection-based execution, which could lead to JSON hijacking and authentication...

Xpoda Studio SQL注入漏洞

Xpoda Studio is a visualization development environment provided by the Turkish company Xpoda. Versions of Xpoda Studio dated back to February 2026 and earlier contained an SQL injection vulnerability. This vulnerability stemmed from improper handling of special elements within SQL commands, whic...

Fikir Odalari AdminPando SQL注入漏洞

Fikir Odalari AdminPando is a backend management system operated by the Turkish company Fikir Odalari. Version 1.0.1 of Fikir Odalari AdminPando before January 26, 2026 contained an SQL injection vulnerability. This vulnerability stemmed from the username and password parameters used in the login...

QRMenümPro Menu Panel security vulnerabilities

QRMenümPro Menu Panel is a backend management panel for the intelligent menu system developed by the Turkish company QRMenümPro. The QRMenümPro Menu Panel versions dated 29012026 and earlier contained security vulnerabilities. These vulnerabilities were caused by user-controllable keys that allow...

Global Interactive Design Media Content Management System Cross-Site Script Vulnerability

Global Interactive Design Media Content Management System is a content management system developed by the Turkish company Global Interactive Design Media. Versions of the Global Interactive Design Media Content Management System prior to version 21072025 contained a cross-site scripting...

Aida Hotel Guest Hotspot security vulnerability

Aida Hotel Guest Hotspot is a hotel WiFi system developed by the Turkish company Aida. Versions of Aida Hotel Guest Hotspot prior to 22012026 contained a security vulnerability caused by improper handling of special elements, which could lead to SQL injection attacks...

EXERT Education Management System has a security vulnerability

EXERT Education Management System is a comprehensive education management software developed by the Turkish company EXERT. The version 23.09.2025 and earlier of the EXERT Education Management System contained security vulnerabilities. These vulnerabilities stemmed from unauthorized access through...

Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. Th...

Restajet Online Food Delivery System 跨站请求伪造漏洞

Restajet Online Food Delivery System is an online food ordering and delivery system from the Turkish company Restajet. A cross-site request forgery vulnerability exists in Restajet Online Food Delivery System 19122025 and earlier versions, which stems from vulnerability to cross-site request...

Frogblight threatens you with a court case: a new Android banker targets Turkish users

In August 2025, we discovered a campaign targeting individuals in Turkey with a new Android banking Trojan we dubbed "Frogblight". Initially, the malware was disguised as an app for accessing court case files via an official government webpage. Later, more universal disguises appeared, such as th...

Neon Güvenlik NVClient 安全漏洞

Neon Güvenlik NVClient is a client software for web video from the Turkish company Neon Güvenlik. A security vulnerability exists in Neon Güvenlik NVClient version 5.0, which stems from a stack buffer overflow in the user-configured contact field that could cause the application to crash...

Seneka Onaylarım 安全漏洞

Seneka Onaylarım is an enterprise-level workflow and approval management system from Seneka, Turkey. A security vulnerability exists in Seneka Onaylarım versions 25.09.26.01 through 18112025, which stems from improper execution of behavioral workflows and could lead to misuse of functionality...

Narkom Pyxis Signage 跨站脚本漏洞

Narkom Pyxis Signage is a digital notice screen management system from Narkom Turkey. A cross-site scripting vulnerability exists in Narkom Pyxis Signage 31012025 and earlier versions, which stems from improper input neutralization and could lead to a stored cross-site scripting attack...

Eksagate Electronic Engineering Webpack Management System 安全漏洞

Eksagate Electronic Engineering Webpack Management System is a management system of the Turkish company Eksagate Electronic Engineering. A security vulnerability exists in Eksagate Electronic Engineering Webpack Management System 20251119 and prior versions, which stems from improper neutralizati...

A Perfect Storm: DDoS Attack Hits Turkish Luxury Retailer During Fall Collection Launch

When high-stakes events meet unprecedented attack volumes, disruption can be devastating. A Turkish luxury retail platform experienced this firsthand when it was hit with a record-breaking application-layer DDoS attack, peaking at 14.2 million requests per second RPS. This marks the largest DDoS...

New Android Banking Trojan "Klopatra" Uses Hidden VNC to Control Infected Smartphones

A previously undocumented Android banking trojan called Klopatra has compromised over 3,000 devices, with a majority of the infections reported in Spain and Italy. Italian fraud prevention firm Cleafy, which discovered the sophisticated malware and remote access trojan RAT in late August 2025, sa...