CVE-2025-58462

CriticalCVSS 9.8/10Last modified Sep 30, 2026

Description

OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could read, write, or delete any content in the underlying database.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2025
Last modified
Sep 30, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-584634.9A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains an administrator account, tCVE-2025-584647.5A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker, they can then exploit the vulnerability tCVE-2025-584655.4A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they canCVE-2025-584664.9A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gainsCVE-2025-584676.5A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-584688.8A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit theCVE-2025-584698.8A cross-site request forgery (CSRF) vulnerability has been reported to affect QuLog Center. The remote attackers can then exploit the vulnerCVE-2025-58478.8A vulnerability has been found in Tenda AC9 15.03.02.13 and classified as critical. Affected by this vulnerability is the function formSetSaCVE-2025-584706.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-584714.9An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains CVE-2025-584724.9A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, theCVE-2025-584735.9An improper resource shutdown or release vulnerability has been identified in the Click Plus C2-03CPU-2 device running firmware version 3.60
CVE-2025-58462: Critical severity, CVSS 9.8 | Vulnix