First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-61194

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/wzy-most/zeyu-Wang/blob/main/sql/readme.mdExploit, Third Party Advisory

Timeline

Published: Oct 21, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-611968.8An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.CVE-2025-611978.9An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 CVE-2025-611985.4A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod CVE-2025-61205.3A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the func CVE-2025-61219.8A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pur CVE-2025-61228.8A vulnerability, which was classified as critical, was found in code-projects Restaurant Order System 1.0. This affects an unknown part of t CVE-2025-612207.5The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unau CVE-2025-612246.5Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q pa CVE-2025-612287.8An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism CVE-2025-612297.8An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary p CVE-2025-61239.8A vulnerability has been found in code-projects Restaurant Order System 1.0 and classified as critical. This vulnerability affects unknown c CVE-2025-612347.5Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentica

CVE-2025-61194: Medium severity, CVSS 6.5 | Vulnix