CVE-2025-67081

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-67081

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67081.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-67081

Published

2026-01-15T15:15:50.740Z

Modified

2026-03-12T22:41:34.831674Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

References

Affected packages

Git / github.com/itflow-org/itflow

Affected ranges

Type

GIT

Repo

https://github.com/itflow-org/itflow

Events

Introduced

Last affected

ed8a576ac36d4c07688804034998ab1e9aad0cd6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "25.06"
        }
    ]
}

Affected versions

v25.*

v25.01

v25.01.2

v25.01.3

v25.02

v25.02.1

v25.02.2

v25.02.3

v25.02.4

v25.03

v25.05

v25.06

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-67081.json"