What is the CVSS score of CVE-2025-67081?

CVE-2025-67081 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Itflow are affected by CVE-2025-67081?

Organizations using Itflow should be aware of moderate risk from CVE-2025-67081, a SQL injection vulnerability rated CVSS 4.9.

How to fix or mitigate CVE-2025-67081?

Within 30 days: Identify affected systems running Itflow and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Itflow CVE-2025-67081

MEDIUM

SQL Injection (CWE-89)

2026-01-15 cve@mitre.org

SQLi Itflow

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 15, 2026 - 15:15 nvd

MEDIUM 4.9

DescriptionCVE.org

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

AnalysisAI

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Itflow. An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.