CVE-2025-61940

HighCVSS 8.8/10Last modified Sep 25, 2026

Description

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User access in the client application is restricted by a password authentication check in the client software but the underlying database connection always has access. The latest version of NMIS/BioDose introduces an option to use Windows user authentication with the database, which would restrict this database connection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-603

Affected software

No affected versions have been published.

Timeline

Published
Dec 2, 2025
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-619418.6A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative CVE-2025-619437.8The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in CaptCVE-2025-619448.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-619459.8Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once insCVE-2025-619494.8LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitraCVE-2025-61954.3GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that CVE-2025-619505.3In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. WCVE-2025-619517.5Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer SCVE-2025-619527.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-619558.8A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.CVE-2025-619569.8Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. AttaCVE-2025-619588.7A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass