PT-2026-137122
CVE-2025-71456
·
Published
2026-11-04
·
Updated
2026-11-04
Description by
CVSS 3.1
8.1
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte userauthtoken, to take over other user accounts.
Found an issue in the description? Have something to add? Feel free to write us 👾