CVE-2025-59816
Authenticated Union based SQL-injection in the search input field
- State
- Published
- Severity
- 7.3 High
- Published
- Sep 25, 2025
- Updated
- Sep 26, 2025
- Reserved
- Sep 22, 2025
Description
This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | NCSC-NL |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
ICX500Zenitel |
|
ICX510Zenitel |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.