CVE-2025-14603 — Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

CVE-2025-14603

Use of user input in raw SQL queries in vsDesk leading to blind SQL injection PUBLISHED

Description (CNA)

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Affected (CNA)

Vendor / product	Versions
vsDesk / vsDesk	affected 11.06.02; unaffected 14.0101

CWE

No CWE identifiers supplied.

References

https://github.com/klsecservices/Advisories/blob/master/KLSA-00295-Blind-SQLi-via-User-Input-in-vsDesk.md

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.