Jettweb PHP Hazir Haber Sitesi Script V3 has a SQL injection flaw that occurs when attackers supply a malicious value to the 'kelime' POST parameter. By exploiting UNION-based payloads, an attacker can read confidential database information or bypass authentication controls, leading to possible data breach and unauthorized access. This weakness corresponds to CWE‑89: Improper Neutralization of Inputs used in an SQL Command.

Affected product is the Jettweb PHP Stock News Site Script version 3, as identified by the CPE cpe:2.3:a:jettweb:php_stock_news_site_script:3:*:*:*:*:*:*.*. The vulnerability applies to all builds labeled version 3; no further sub‑version granularity is provided.

The CVSS score of 8.8 denotes high severity. The EPSS score of less than 1% suggests exploitation is currently uncommon but still plausible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires sending a crafted POST request containing a malicious 'kelime' value; authentication is not needed, implying a direct web‑application attack vector. Even with low exploitation probability, the impact warrants prompt action.