Which versions of Zeon Academy Pro are affected by EUVD-2025-209544?

Zeon Academy Pro contains a critical SQL injection vulnerability in its file upload functionality that allows unauthenticated remote attackers to fully compromise the application database.. A patch is available.

How to fix or mitigate EUVD-2025-209544?

Within 24 hours: Identify all systems running Zeon Academy Pro and immediately disable or restrict network access to /private/continue-upload.php. Within 7 days: Contact Zeon Academy Pro vendor for specific patched version number and apply patch across all instances. Within 30 days: Audit database activity logs between vulnerability discovery and patching; conduct forensic review for unauthorized SQL command execution; rotate database credentials and review user access logs.

Zeon Academy Pro EUVD-2025-209544

Q: What is the CVSS score of EUVD-2025-209544?

EUVD-2025-209544 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-41029 CRITICAL

SQL Injection (CWE-89)

2026-04-21 INCIBE

GHSA-xxv5-96j3-4f5j

PHP SQLi

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 16:31 vuln.today

CVSS changed

Apr 21, 2026 - 16:22 NVD

9.3 (CRITICAL)

EUVD ID Assigned

Apr 21, 2026 - 15:30 euvd

EUVD-2025-209544

Analysis Generated

Apr 21, 2026 - 15:30 vuln.today

Patch released

Apr 21, 2026 - 15:30 nvd

Patch available

CVE Published

Apr 21, 2026 - 14:59 nvd

CRITICAL 9.3

DescriptionCVE.org

SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'.

AnalysisAI

SQL injection in Zeon Academy Pro allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'phonenumber' parameter in /private/continue-upload.php, enabling full database compromise including data exfiltration, modification, and deletion. The vulnerability is exploitable over the network without authentication (CVSS:4.0 9.3 Critical, AV:N/PR:N), representing a complete compromise of database confidentiality and integrity. Patch available from vendor per INCIBE-CERT advisory, though specific fixed version not disclosed in public references.

Technical ContextAI

This is a classic SQL injection (CWE-89) vulnerability in a PHP web application endpoint. The /private/continue-upload.php script fails to properly sanitize or parameterize the 'phonenumber' POST parameter before incorporating it into SQL queries. Zeon Academy Pro (CPE: cpe:2.3:a:zeon_global_tech:zeon_academy_pro) is an educational management platform by Zeon Global Tech. SQL injection occurs when user-controlled input is directly concatenated into SQL statements without proper escaping or prepared statements, allowing attackers to break out of the intended query structure and execute arbitrary SQL commands. The 'private' directory path suggests this endpoint may have been intended for internal or administrative functions but lacks proper access controls and input validation. PHP applications are particularly susceptible to SQLi when using legacy mysql_* functions or improperly implemented mysqli/PDO queries without parameter binding.

RemediationAI

Apply the vendor-released patch referenced in the INCIBE-CERT advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech. Contact Zeon Global Tech directly for specific patched version details and upgrade instructions, as the public advisory does not disclose exact version numbers. As immediate compensating controls while awaiting patch deployment, restrict network access to /private/continue-upload.php using web application firewall (WAF) rules or web server access controls to block external requests (note: this breaks functionality for legitimate external users of the upload feature). Alternatively, implement strict input validation at the web server or WAF layer to block SQL metacharacters in the 'phonenumber' parameter (single quotes, semicolons, comment markers), though this is fragile and may be bypassed by encoding techniques. Monitor database query logs for anomalous SELECT, UNION, or administrative SQL statements originating from the application account. Neither workaround is a substitute for the vendor patch, as attackers may find encoding bypasses or the endpoint may be legitimately accessible to authenticated users who could still exploit it.