CVE-2025-26348

Summary

CVE-2025-26348 is a SQL injection vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. An authenticated attacker can exploit the editUserMenu endpoint in maxprofile/menu/model.lua by introducing malicious SQL commands in HTTP requests. This vulnerability, classified as CWE-89, could allow the attacker to execute arbitrary SQL queries and potentially gain unauthorized access to sensitive data. Successful exploitation requires authentication, but it poses a significant risk if not promptly addressed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.