CVE-2025-66944

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vran-dev/databasir/issues/283Exploit, Issue Tracking
https://zeroday.endlessparadox.com/posts/cve-2025-66944/Exploit, Third Party Advisory

Timeline

Published: Mar 4, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-669459.1A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /CVE-2025-669476.5SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An CVE-2025-66954.1A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the fi CVE-2025-669538.8CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based CVE-2025-669546.5A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid use CVE-2025-669556.5Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access file CVE-2025-669569.9Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute CVE-2025-669597.5An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the GGUF decoder CVE-2025-66964.1A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file CVE-2025-669607.5An issue in ollama v.0.12.10 allows a remote attacker to cause a denial of service via the fs/ggml/gguf.go, function readGGUFV1String reads CVE-2025-669635.5An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html CVE-2025-669697.5Integer overflow in OpenModSim (<=1.11.0), leading to denial of service