External risk intelligence

Xpoda No Code Platform SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-2395

The vulnerability affects a no-code platform used for building applications. Such platforms are commonly deployed as internet-facing web applications or portals to allow access for users or external stakeholders, making the attack surface frequently exposed to the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A SQL injection vulnerability has been identified in a no-code platform, potentially allowing unauthorized access to and manipulation of underlying data. This issue could impact applications built using this platform if it is deployed in internet-facing environments. The primary concern is to confirm if this technology is in use and assess the potential exposure.

SQL injection allows data compromise.
No-code platforms commonly face the internet.
Confirm platform use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to the No Code Platform, as it improperly handles data intended for SQL commands. This could allow an attacker to manipulate database queries, potentially leading to unauthorized access, modification, or deletion of data. The vendor has not responded to inquiries about this issue.

No authentication or special access required.
Specially crafted input to vulnerable component.
Leads to sensitive data exposure and modification.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in the No Code Platform could allow an unauthenticated attacker to execute arbitrary SQL commands. When supported by the advisory, this could affect the integrity and availability of the platform and its underlying data.

Platform data integrity and availability.
Remote attackers can inject malicious SQL queries.
Data corruption or unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform requires action from application owners and potentially the infrastructure or platform teams responsible for its deployment. The immediate priority is to identify all instances of the affected platform, confirm their exposure and business criticality, and assign an owner for remediation. Planning should then focus on risk-based actions, considering the vendor's lack of response.

Application owners must manage this issue.
Verify platform reachability and business impact.
Plan vendor coordination or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Xpoda No Code Platform?

Xpoda No Code Platform is a software environment that allows users to design and deploy business applications without writing traditional code. It serves as a foundation for building internal portals, data entry interfaces, and operational dashboards that connect directly to backend databases.

What does SQL injection mean for CVE-2026-2395?

This vulnerability, classified as CWE-89, happens when the platform fails to properly clean user-provided input before using it in a database query. Because the software treats this input as part of an official command, an attacker can trick the system into running unauthorized queries, which may grant them access to sensitive data or allow them to modify existing database records.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending specifically crafted input to the platform, such as through a web form or URL parameter. It is important to note that no authentication is required to trigger this; the platform's failure to sanitize input allows the malicious command to execute automatically regardless of the user's login status.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal notes that since Xpoda is a no-code platform often deployed as an internet-facing portal to reach external stakeholders, it is frequently exposed to the public internet. If your platform instance is accessible via a public web address, it carries a higher risk because it does not require an attacker to have prior access to your internal network.

What should I do if I use Xpoda No Code Platform?

Your first step is to locate all instances of the platform within your environment to determine which are internet-facing. Since the vendor has not provided a response to this disclosure, you should evaluate the business impact of these instances and consult with your infrastructure teams to discuss restricting network access or implementing compensating controls until further information becomes available.

References

siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0608

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.