Jettweb PHP Hazir Haber Sitesi Scripti V3 contains a SQL injection flaw that allows an unauthenticated attacker to inject SQL code into the videoid parameter of fonksiyonlar.php. By crafting a GET request that includes UNION-based injection syntax, an attacker can cause the application to return sensitive information from the database, potentially exposing confidential data and undermining data integrity.

The vulnerability affects installations of the Jettweb Hazir Haber Sitesi Scripti product. Version details are not supplied in the advisory, so all deployed editions should be assumed at risk until a vendor update is confirmed.

The CVSS score of 8.8 reflects high severity. An EPSS score of less than 1% indicates a low current exploitation likelihood. The flaw is remotely exploitable over the network without authentication, using standard HTTP GET requests to fonksiyonlar.php. It is not listed in the CISA KEV catalog, but the ability to extract database contents makes it a critical risk if left unpatched.