CVE-2025-59816

HighCVSS 7.3/10Last modified Oct 18, 2026

Description

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 25, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-598178.4This vulnerability allows attackers to execute arbitrary commands on the underlying system. Because the web portal runs with root privileges CVE-2025-598189.8This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded CVE-2025-598196.5This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path.CVE-2025-59827.5An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Und CVE-2025-598206.7In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kis_tga_import.CVE-2025-598216.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s CVE-2025-598227.5Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTT CVE-2025-598239.9Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Ga CVE-2025-598245.4Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential CVE-2025-598256.1astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives ma CVE-2025-598267.6Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, non-admin users can create arbitrary challenges, potentially introducing CVE-2025-598279.8Flag Forge is a Capture The Flag (CTF) platform. In version 2.1.0, the /api/admin/assign-badge endpoint lacks proper access control, allowin