CVE-2025-27495

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateTrace' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25911)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 16, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274963.3Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver CVE-2025-274978.7OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the servCVE-2025-274985.7aes-gcm is a pure Rust implementation of the AES-GCM. In decrypt_in_place_detached, the decrypted ciphertext (which is the correct ciphertexCVE-2025-274996.1WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerabCVE-2025-27508.8A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSCVE-2025-275006.1OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint(/api/upload) on the admin panel caCVE-2025-275018.6OpenZiti is a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessedCVE-2025-275055.3GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API securiCVE-2025-275066.1NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to ReflecteCVE-2025-275079.0The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API coCVE-2025-275087.5Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it CVE-2025-275099.3fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-fo