CVE-2025-32993

Summary

CVE-2025-32993 is a vulnerability affecting Vision Helpdesk versions up to 5.7.0. This issue enables Time-Based Blind SQL injection attacks through the Forgot Password functionality, accessible via the index.php?/home/forgot-password endpoint. Unlike other SQL injection vulnerabilities, no authentication is required to exploit this weakness, posing a significant risk to unpatched systems. Successful exploitation allows attackers to extract sensitive data from affected databases. It is crucial for organizations using VisionHelpdesk to apply the necessary patch to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.