| TVN ID | TVN-202511002 |
|---|---|
| CVE ID | CVE-2025-12864, CVE-2025-12865 |
| CVSS | CVE-2025-12864： 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2025-12865： 8.8 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Affected Products | U-Office Force before version 29.50 |
| Description | CVE-2025-12864(SQL Injection)： Authenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database contents. CVE-2025-12865(SQL Injection)： Authenticated remote attacker can inject arbitrary SQL commands to read, modify, and delete database contents. |
| Solution | Update to version 29.50 or later. |
| Credit | yc(CHT Security) |
| Public Date | 2025-11-10 |
:::