CVE-2025-26346

CVSS 3.1 Score 5.5 of 10 (medium)

Details

Published Feb 12, 2025
CWE ID 89

Summary

CVE-2025-26346 is a SQL injection vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. In the editUserGroupMenu endpoint of maxprofile/menu/model.lua, an improper neutralization of special elements in an SQL command occurs. This issue allows authenticated attackers to execute arbitrary SQL commands by crafting malicious HTTP requests. Successful exploitation could lead to unauthorized access to sensitive data or even system takeover.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Q-Free Maxtime

Affected Vendors

  • Nozomi Networks

Advisories, Assessments, and Mitigations