What’s Vulnerable › Vulnerabilities

CVE-2025-32993

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-15 · updated 2026-06-17
• Weakness: CWE-89

Description

Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter. Authentication is not needed.

Affected products

• Vision Helpdesk: through 5.7.0

References

• https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab
• https://www.visionhelpdesk.com/vision-helpdesk-v5-7-0-stable-version-released.html
• https://nav1n.medium.com/sql-injection-in-vision-helpdesk-tools-a83dfc27f3ab

Get alerted when CVE-2025-32993 or the next vulnerability affects your stack