What is the CVSS score of CVE-2025-24290?

CVE-2025-24290 has a CVSS 3.0 base score of 9.9 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of UISP Application are affected by CVE-2025-24290?

UISP Application versions 2.4.206 and earlier contain critical SQL injection flaws that allow low-privilege users to escalate their access rights and potentially compromise the entire application…. A patch is available.

How to fix or mitigate CVE-2025-24290?

Within 24 hours: Identify all UISP instances running version 2.4.206 or earlier in your environment and document current user privilege levels. Within 7 days: Apply the latest vendor-released patch to all affected UISP servers and validate successful deployment. Within 30 days: Conduct access log review for the past 90 days to detect any anomalous privilege escalation attempts, and reset credentials for all administrative accounts as a precautionary measure.

UISP Application CVE-2025-24290

EUVD-2025-19541 CRITICAL

SQL Injection (CWE-89)

2025-06-29 support@hackerone.com

SQLi

9.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:53 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.4.211

EUVD ID Assigned

Mar 16, 2026 - 01:15 euvd

EUVD-2025-19541

Analysis Generated

Mar 16, 2026 - 01:15 vuln.today

CVE Published

Jun 29, 2025 - 20:15 nvd

CRITICAL 9.9

DescriptionCVE.org

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.

Analysis

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.