CVE-2025-62575

HighCVSS 8.8/10Last modified Sep 25, 2026

Description

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and other created accounts by default have the sysadmin role. This can lead to remote code execution through the use of certain built-in stored procedures.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-625778.4ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged user with access to CVE-2025-625787.5DVP-12SE - Modbus/TCP Cleartext Transmission of Sensitive Information CVE-2025-625797.8ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2025-62586.4The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions CVE-2025-625807.8ASDA-Soft Stack-based Buffer Overflow Vulnerability CVE-2025-625819.8Delta Electronics DIAView has multiple vulnerabilities.CVE-2025-625829.8Delta Electronics DIAView has multiple vulnerabilities.CVE-2025-625839.8Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.CVE-2025-625847.5Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.CVE-2025-625857.5Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.CVE-2025-625869.8OPEXUS FOIAXpress allows a remote, unauthenticated attacker to reset the administrator password. Fixed in FOIAXpress version 11.13.2.0.CVE-2025-625878.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.