CVE-2025-67081

MEDIUM

4.9

Descricao

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

Detalhes CVE

Pontuacao CVSS v3.14.9

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado1/15/2026

Ultima modificacao1/23/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

itflow:itflow

Fraquezas (CWE)

CWE-89

Referencias

https://github.com/itflow-org/itflow(cve@mitre.org)

https://www.helx.io/blog/advisory-itflow/(cve@mitre.org)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.