CVE-2025-71456

HighCVSS 8.1/10Last modified Nov 12, 2026

Description

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
vtenext	vtenext	< 25.02.2

References

Timeline

Published: Nov 4, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-714579.8vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account pas CVE-2025-714587.5FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the CVE-2025-714598.1Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload director CVE-2025-71467.5The iPublish System developed by Jhenggao has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to read arb CVE-2025-714604.2Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated us CVE-2025-714615.3Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recoverin CVE-2025-714626.1Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplyi CVE-2025-714636.7Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by CVE-2025-714646.1@kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns source view text to inn CVE-2025-714656.1@kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML from ngModel or reactive CVE-2025-71479.8A vulnerability has been found in CodeAstro Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability CVE-2025-71485.4A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some u