CVE-2025-59387CWE-89sql-injection

CVE-2025-59387

published January 2, 2026

CVSS

8.1

EPSS

Percentile

30.3

In the wild

Unconfirmed

What it is

An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version:

MARS (Multi-Application Recovery Service) 1.2.1.1686 and later

The record

Technical detail

CVSS: 8.1 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00375 · 30.3th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-01-02T21:17Z

References (1)

https://www.qnap.com/en/security-advisory/qsa-25-53 · [email protected]

EPSS history

Timeline

02 JAN 15:19Z
MARS (Multi-Application Recovery Service)
cvelistv5