CVE-2025-67811

—

CVSS 3.1

6.5 medium

EPSS

<1%p22

Published

Jan 9, 2026 (Jan 9, 2026)

Modified

Jun 17, 2026

Description

Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.

Vendors: area9lyceum
Products: rhapsode
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.