The vulnerability is a classic SQL injection in Jettweb PHP Hazir Haber Sitesi Scripti V3, where attackers can exploit the 'kelime' parameter in POST requests with UNION-based payloads to read or modify database data. This flaw is identified as CWE-89 and carries a high CVSS score of 8.8, indicating a significant threat to confidentiality and integrity.

Affected systems are the Jettweb PHP Stock News Site Script V3. The CPE identifier cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*:* indicates that all instances of the v3 release are vulnerable. No specific sub‑version data is listed, so any deployment of version 3 should be considered at risk.

The vulnerability is high severity (CVSS 8.8) but its EPSS score is lower than 1%, implying that active exploitation is currently rare. The attack requires network access to the web application: an attacker must send a crafted POST request to the endpoint that processes the 'kelime' parameter. No patch or workaround is listed in the CVE record; the flaw is not included in the CISA KEV catalog. The main risk is the potential extraction of sensitive database content or unauthorized modification of records, which could lead to data breach and integrity damage.