CVE-2025-41678

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-416797.5An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only CVE-2025-41686.4The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up CVE-2025-416814.8A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to creat CVE-2025-416828.8An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.CVE-2025-416838.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416848.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-416879.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected de CVE-2025-416887.2A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sand CVE-2025-416897.5An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only CVE-2025-41696.4The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all ve