Loading story…
Two newly documented vulnerabilities, CVE-2025-41007 and CVE-2025-41008, expose Cuantis and Sinturno to unauthenticated SQL injection attacks. In Cuantis, the flaw affects the /search.php endpoint through the search parameter, while in Sinturno the issue is in the client parameter of /_adm/scripts/modalReport_data.php. Both vulnerabilities are classified as CWE-89 and can be exploited remotely with low attack complexity and no required privileges or user interaction.
The CVE records state that successful exploitation could let attackers retrieve, create, update, and delete database contents, creating high risk to confidentiality, integrity, and availability. The issues were received by cve-coordination@incibe.es, and an INCIBE reference notice was published for the Cuantis flaw, underscoring the need for affected organizations to identify exposed instances and prioritize remediation of these internet-reachable database attack paths.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The CVE-2025-41008 record was published on 2026-03-23 with technical details describing the Sinturno SQL injection flaw, its CWE-89 classification, and a CVSS v4.0 vector indicating network-based exploitation with low attack complexity.
INCIBE published a reference notice for CVE-2025-41007 on its website, documenting the Cuantis SQL injection vulnerability and its classification as CWE-89. The publication is associated with the CVE entry published on 2026-03-23.
On 2026-03-23, cve-coordination@incibe.es received a report for CVE-2025-41008, a SQL injection vulnerability in Sinturno affecting the client parameter of /_adm/scripts/modalReport_data.php. The flaw could allow an unauthenticated attacker to retrieve, create, update, and delete databases.
On 2026-03-23, cve-coordination@incibe.es received a report for CVE-2025-41007, a SQL injection flaw in Cuantis affecting the /search.php endpoint via the search parameter. The issue could allow an unauthenticated attacker to retrieve, create, update, and delete databases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
A critical SQL injection flaw tracked as **`CVE-2026-72811`** affects **SiYuan** versions before **`3.7.4`**, allowing remote attackers to execute arbitrary SQL through the application's backlink and mention search functionality. The bug stems from unsafe construction of a SQL `MATCH` query in `kernel/model/backlink.go`, where stored block metadata and user-supplied keywords are concatenated into a search statement with incomplete escaping, letting attackers break out of string literals using single quotes. The vulnerability is remotely reachable through the publish surface, including by anonymous users or users with **RoleReader** access, and can also be exploited as a second-order injection via stored document metadata. Because the query runs against the main read-write **`siyuan.db`** handle and the database driver supports statement stacking, successful exploitation can result in arbitrary SQL execution and cross-notebook read and write access. The issue is classified as **CWE-89**, carries a **CVSS v3.1 score of 10.0** and **CVSS v4.0 score of 9.9**, and is fixed in **SiYuan `3.7.4`**.
Aug 14, 2026
TWCERT/CC published advisories for two high-severity enterprise software vulnerabilities that could let attackers compromise backend systems and data. **CVE-2026-5965** affects **NewSoftOA** from NewSoft and is an **OS command injection** flaw (`CWE-78`) that allows **unauthenticated remote attackers** to execute arbitrary operating system commands on the server. The issue carries a `CVSS v3.1` score with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating low-complexity network exploitation with high impact across confidentiality, integrity, and availability. A second advisory, **CVE-2026-7489**, affects **Sunnet CTMS** and describes a **SQL injection** vulnerability (`CWE-89`) that allows **authenticated remote attackers** to run arbitrary SQL commands against the application database. Successful exploitation could enable reading, modifying, and deleting database contents, with a `CVSS v3.1` vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. Both vulnerabilities were published with English and Chinese references by TWCERT/CC, underscoring continued exposure in internet-reachable business applications to injection attacks that can lead to full server compromise or severe database manipulation.
Jun 29, 2026