CVE-2025-3707 in eHRD CTMS

Résumé

par MITRE • 02/05/2025

The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsable: Twcert
• Réserver: 16/04/2025
• Divulgation: 02/05/2025
• Modérer: accepté
• Entrée: VDB-307167
• CPE: prêt
• CWE: CWE-89 (confirmé)
• CVSS: 6.5 (CNA)
• EPSS: 0.00405
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3707
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3707
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3707/