CVE-2025-67811

Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users

Medium · published January 9, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Published
2026-01-09T00:00Z
EPSS history
Timeline
  • 09 JAN 00:00Z
    Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users
    cvelistv5