TI-2025-05920 Aliases CVE-2025-6520 GHSA-8mr7-33q4-78g5

SQLi in Abis Technology's BAPSIS

MEDIUM 49CWE-89Published 2025-10-31 · Updated 2026-06-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00371 31st percentileScored 2026-11-07

Fix Fixed BAPSIS (Abis Technology): 202510271606

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ABIS Technology Ltd. Co.	BAPSIS	before 202510271606	202510271606	Patch available	CNA

BAPSIS VendorABIS Technology Ltd. Co. Affected before 202510271606 Fixed in 202510271606 Patch available CNA

Remediation

Fix · CNA BAPSIS (Abis Technology) Fixed in 202510271606

Timeline

2026-10-02 Threatist record created from CVE-2025-6520
2026-10-03 Alias added: GHSA-8mr7-33q4-78g5

References

Other 2

TI-2026-05264 IDOR in Abis Technology's BAPSİS CVSS 3.1HIGH 8.8
TI-2026-06578 Improper Access Control in Abis Technology's AVESİS CVSS 3.1MEDIUM 5.3
TI-2026-55519 Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences