CVE-2025-8587: SQL Injection in AKCE SKSPro

CVE-2025-8587 is a high severity (CVSS 8.6) SQL injection in SKSPro from AKCE Software Technology R&D Industry and Trade Inc., through build 07012026. The record names no fixed build, so ask the vendor for one, read the Turkish national advisory and limit access to the application.

What's affected

The record lists AKCE SKSPro, builds through 07012026. It names no fixed build. The national advisory (USOM, TR-26-0011) is the place to check status.

How to check if you're exposed

1. Find the SKSPro build in the application or from the vendor documentation.
2. Compare it with 07012026.
3. Ask the vendor which build fixes the issue, and read the USOM advisory.
4. Review web server and database logs for unexpected query errors.

What to do now

1. Confirm whether SKSPro is in use and where it is reachable from.
2. Ask the vendor for a fixed build and apply it when available.
3. Limit network access to the application to the users who need it, and keep it off the open internet if possible.
4. Check that the database account used by the application has only the rights it needs.
5. Review logs for suspicious requests since the disclosure date.

Why it matters

The weakness is CWE-89 (SQL injection). Input reaches a database query without neutralisation, so it can change what the query does. The CVSS vector needs no login and no user interaction, and rates availability as the highest impact with low impact on confidentiality and integrity.

Parameterised queries remove this whole class of bug. The record does not mark this as exploited, and it is not in the CISA KEV list.

Quick check

If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.

Sources

Referenced by the CVE record (not independently fetched for this guide):

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0011
• https://www.usom.gov.tr/bildirim/tr-26-0011

Last reviewed: 19 October 2026.