CVE-2025-62384

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2025
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-623856.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623866.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623876.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623886.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623896.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-62396.5Zohocorp ManageEngine Applications Manager versions 176800 and below are vulnerable to information disclosure in File/Directory monitor.CVE-2025-623906.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623916.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623926.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataCVE-2025-623934.3A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorizedCVE-2025-623944.3Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive qCVE-2025-623954.3A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system contex
CVE-2025-62384: Medium severity, CVSS 6.5 | Vulnix