CVE-2025-6276

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Brilliance Golden Link Secondary System up to 20250609. It has been rated as critical. Affected by this issue is some unknown functionality of the file /storagework/rentTakeInfoPage.htm. The manipulation of the argument custTradeName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 19, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-627606.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode CVE-2025-627616.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BasePress Knowledge Base documentation CVE-2025-627624.3Cross-Site Request Forgery (CSRF) vulnerability in photoboxone SMTP Mail smtp-mail allows Cross Site Request Forgery.This issue affects SMTP CVE-2025-627635.0Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.CVE-2025-627657.5General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe n CVE-2025-62779.8A vulnerability classified as critical has been found in Brilliance Golden Link Secondary System up to 20250609. This affects an unknown par CVE-2025-627717.5Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.CVE-2025-627723.1On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.CVE-2025-627732.4Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.CVE-2025-627743.1On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.CVE-2025-627758.0Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.CVE-2025-627768.4The installer of WTW EAGLE (for Windows) 3.0.8.0 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Li