CVE-2025-10266CWE-89

NewType Infortech|NUP Portal - SQL Injection

Critical · published September 12, 2025

CVSS v4.0
9.3
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

🚨 Unauthenticated attackers can unleash chaos with a simple SQL injection attack on NUP Pro! 🔥 Think of this vulnerability like a sneaky intruder who finds a way into your database's kitchen, rummaging through your recipes, altering them, or even throwing out your best dishes altogether! 🍽️ The consequences of this SQL injection are absolutely devastating. An attacker could read sensitive data, modify crucial information, or delete entire datasets, leaving your application in utter disarray. This could lead to significant data breaches and loss of trust from your users.

Put simply

Think of this vulnerability like a sneaky intruder who finds a way into your database's kitchen, rummaging through your recipes, altering them, or even throwing out your best dishes altogether! 🍽️ This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands into the database, enabling unauthorized access and manipulation of its contents.

What to do

The consequences of this SQL injection are absolutely devastating. An attacker could read sensitive data, modify crucial information, or delete entire datasets, leaving your application in utter disarray. This could lead to significant data breaches and loss of trust from your users. Immediate action is essential! Update NUP Pro to the latest version that addresses this vulnerability, secure your database with prepared statements, and conduct a thorough audit of your SQL queries to ensure there are no other weak points. You've got this! Follow these steps and you'll lock down your database in no time. 🛡️

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00574 · 46.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-12T10:19Z
EPSS history
Timeline
  • 12 SEP 10:19Z
    NewType Infortech|NUP Portal - SQL Injection
    cvelistv5