What is the CVSS score of CVE-2025-49049?

CVE-2025-49049 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of ZoomIt DZS Video Gallery are affected by CVE-2025-49049?

A critical SQL injection vulnerability exists in ZoomIt DZS Video Gallery (versions up to 12.37) that could allow attackers to directly access, modify, or exfiltrate sensitive database content…

How to fix or mitigate CVE-2025-49049?

Within 24 hours: Audit all systems running DZS Video Gallery to identify affected versions and document business criticality; disable the plugin if not essential. Within 7 days: Implement WAF rules to block SQL injection patterns targeting the gallery endpoints; apply network segmentation to restrict database access. Within 30 days: Plan either migration to alternative gallery solutions or contact vendor for patch availability; conduct vulnerability assessment of databases potentially accessed through the gallery.

ZoomIt DZS Video Gallery CVE-2025-49049

HIGH

SQL Injection (CWE-89)

2026-01-22 audit@patchstack.com

SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:15 nvd

HIGH 8.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.37.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects ZoomIt DZS Video Gallery dzs-videogallery. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.37.

Affected ProductsAI

Product: ZoomIt DZS Video Gallery dzs-videogallery.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.