CVE-2025-67081

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-67081

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67081.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-67081

Published

2026-01-15T00:00:00Z

Modified

2026-08-12T03:51:44.000952620Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67081.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/itflow-org/itflow

Affected ranges

Type

GIT

Repo

https://github.com/itflow-org/itflow

Events

Introduced

Fixed

ed8a576ac36d4c07688804034998ab1e9aad0cd6

Database specific

Show details

{
    "cpe": "cpe:2.3:a:itflow:itflow:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "25.06"
        },
        {
            "last_affected": "25.06"
        }
    ],
    "source": [
        "DESCRIPTION",
        "CPE_RANGE"
    ]
}

Affected versions

v25.*

v25.01

v25.01.2

v25.01.3

v25.02

v25.02.1

v25.02.2

v25.02.3

v25.02.4

v25.03

v25.05

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67081.json"