Which versions of PHP are affected by CVE-2025-41007?

Organizations using SQL Injection in Cuantis. This vulnerability face critical risk from CVE-2025-41007, a SQL injection vulnerability rated CVSS 9.3.. A patch is available.

How to fix or mitigate CVE-2025-41007?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Validate that input sanitization is in place for all user-controlled parameters.

PHP CVE-2025-41007

Q: What is the CVSS score of CVE-2025-41007?

CVE-2025-41007 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208933 CRITICAL

SQL Injection (CWE-89)

2026-03-23 INCIBE

GHSA-x9c9-7xxr-rwfg

PHP SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 12:45 euvd

EUVD-2025-208933

Analysis Generated

Mar 23, 2026 - 12:45 vuln.today

Patch released

Mar 23, 2026 - 12:45 nvd

Patch available

CVE Published

Mar 23, 2026 - 12:08 nvd

CRITICAL 9.3

DescriptionCVE.org

SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search.php' endpoint.

AnalysisAI

A SQL injection vulnerability exists in Cuantis that allows unauthenticated attackers to execute arbitrary SQL commands through the 'search' parameter in the '/search.php' endpoint. This vulnerability enables complete database compromise including retrieval, creation, modification, and deletion of database contents. A patch is available from the vendor, and exploitation requires only network access to the affected application with no special privileges or user interaction.

Technical ContextAI

The vulnerability is a classic SQL injection flaw (CWE-89) in a PHP-based application (Cuantis) where user input from the 'search' parameter is not properly sanitized or parameterized before being passed to SQL queries. The affected product is identified via CPE as cpe:2.3:a:cuantis:cuantis:*:*:*:*:*:*:*:*, indicating all versions of Cuantis are potentially vulnerable. The '/search.php' endpoint fails to use prepared statements or input validation, allowing attackers to inject malicious SQL syntax directly into database queries. This is a server-side vulnerability in the PHP application layer, exploitable remotely through HTTP GET or POST requests.

RemediationAI

Apply the vendor-supplied patch immediately, available from INCIBE-CERT at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-cuantis. If immediate patching is not feasible, implement network segmentation to restrict access to the '/search.php' endpoint to trusted IP ranges only, disable the search functionality at the web server level using URL rewriting rules, and implement Web Application Firewall (WAF) rules to block SQL injection patterns in the search parameter such as common injection keywords (UNION, SELECT, DROP, etc.). Additionally, review database user permissions to ensure the Cuantis application account operates with minimal necessary privileges (least privilege principle) to limit damage from successful injection attempts. Monitor application logs for suspicious SQL syntax patterns and database access anomalies.