Which versions of bicycleSharingServer are affected by CVE-2025-6749?

Organizations using huija bicycleSharingServer should be aware of moderate risk from CVE-2025-6749, a injection vulnerability rated CVSS 6.3.

How to fix or mitigate CVE-2025-6749?

Within 30 days: Identify affected systems running huija bicycleSharingServer and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

bicycleSharingServer CVE-2025-6749

Q: What is the CVSS score of CVE-2025-6749?

CVE-2025-6749 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-28763 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-27 cna@vuldb.com

SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Attack vector network, complexity low, requires authentication (PR:L), low impact consistent with CVSS 4.0 vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-28763

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 02:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability classified as critical was found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this vulnerability is the function searchAdminMessageShow of the file AdminController.java. The manipulation of the argument Title leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.

AnalysisAI

SQL injection in bicycleSharingServer's AdminController.java allows remote authenticated low-privilege users to manipulate the Title parameter, potentially leading to limited data exposure or modification. Public exploit code exists (GitHub issue) but no active exploitation reported and EPSS score is low (0.04%), indicating low real-world exploitation likelihood.

Technical ContextAI

The affected product is a Java-based bicycle sharing server application. The vulnerability resides in AdminController.java, likely a Spring MVC controller that handles administrative requests. The Title parameter is passed into a SQL query without proper sanitization, falling under CWE-74 (Improper Neutralization of Special Elements used in an SQL Command). The CPE data is not available, but the EUVD identifies commit 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a as affected. Given the low CVSS impact metrics, the database user likely has restricted privileges, limiting the potential damage.

RemediationAI

No vendor-released patch is available because the project does not implement versioning. The recommended remediation is to apply input validation and parameterized queries (prepared statements) for the Title parameter in AdminController.java. As a workaround, restrict network access to the admin endpoint (e.g., via firewall rules or reverse proxy authentication) to limit exposure. Side effect: legitimate admin users may need additional access steps. If the application is custom, developers should sanitize SQL inputs immediately.