Web
CVE-2025-8220
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 12.0.0.3 is sufficient to fix this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Engeman Web versions up to 12.0.0.2 allows remote attackers to manipulate database queries via the LanguageCombobox cookie on the password recovery page. Exploit code is publicly available, but no active exploitation is reported; EPSS indicates low probability of widespread exploitation.
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests
Remote code execution in Web::Passwd 0.03 and earlier allows unauthenticated network attackers to execute arbitrary syst
Input validation vulnerability in Centreon Open Tickets module allows authenticated attackers to manipulate ticket data,
Arbitrary file upload in the Really Simple CSV Importer WordPress plugin (versions <= 1.3) lets an authenticated adminis
Web::API 2.8 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographica
Stored HTML injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows authenticated high-privilege users to i
Share
External POC / Exploit Code
Leaving vuln.today