CVE-2026-18782: SQL Injection in Trex Digital Manufacturing's Trex MES
Published Sep 30, 2026
·Updated
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection.
This issue affects Trex MES: through 2026-09-29.
Affected Software
1 affected component
Trex Digital Manufacturing Systems Trex MES
Event History
Sep 30, 2026
CVE Published
via MITRE·02:15 PM
Data Sourced
via MITRE·02:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:22 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction, according to the provided CVSS vector.
2
What is the potential impact of successful exploitation?
Successful SQL injection can lead to command-line execution. The reported impact includes high confidentiality, integrity, and availability impact.
3
Which Trex MES versions are affected?
Trex MES is reported as affected through 2026-09-29. No fixed version or remediation release is provided in the available data.