CVE-2025-29894

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) and later

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-298952.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-298962.3A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-298972.3A buffer copy without checking size of input vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoCVE-2025-298986.5An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, theCVE-2025-298996.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainsCVE-2025-29905.3A vulnerability was found in Tenda FH1202 1.2.0.14(408). It has been rated as critical. This issue affects some unknown processing of the fiCVE-2025-299006.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gainsCVE-2025-299016.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2025-2990210.0Remote code execution that allows unauthorized users to execute arbitrary code on the server machine.CVE-2025-299037.8In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possibleCVE-2025-299045.3In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleCVE-2025-299058.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj
CVE-2025-29894: High severity, CVSS 8.8 | Vulnix