CVE-2025-62849

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following versions: QTS 5.2.7.3297 build 20251024 and later QuTS hero h5.2.7.3297 build 20251024 and later QuTS hero h5.3.1.3292 build 20251024 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-62856.1A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unCVE-2025-628507.2A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote attacker gains an adminCVE-2025-628514.4A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can thenCVE-2025-628526.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administraCVE-2025-628536.5A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit CVE-2025-628546.5An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, thCVE-2025-628554.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can thenCVE-2025-628564.4A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can thenCVE-2025-628576.1A cross-site scripting (XSS) vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to bCVE-2025-628586.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administraCVE-2025-62866.1A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown functiCVE-2025-628624.6Ampere AmpereOne AC03 devices before 3.5.9.3, AmpereOne AC04 devices before 4.4.5.2, and AmpereOne M devices before 5.4.5.1 allow an incorre
CVE-2025-62849: Critical severity, CVSS 9.8 | Vulnix