CVE-2025-59816CWE-89sql-injection

CVE-2025-59816

High · published September 26, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including user credentials. User passwords are stored in plaintext, significantly increasing the severity of this issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-26T00:15Z
References (2)
https://wiki.zenitel.com/wiki/Downloads#ICX-AlphaCom_System · [email protected]https://wiki.zenitel.com/wiki/ICX_1.4.3.X_-_Release_Notes · [email protected]
EPSS history
Timeline
  • 25 SEP 19:30Z
    Authenticated Union based SQL-injection in the search input field
    cvelistv5