CVE-2025-71458

Name of the Vulnerable Software and Affected Versions FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 FTS3 Web Monitoring (fts-monitoring) version 3.14.0

Description An unauthenticated SQL injection exists in the '/linkinfo' endpoint handled by the get linkinfo() function. Remote attackers can use the source se and dest se query parameters to perform blind injection, allowing them to read stored cloud storage credentials and token provider client secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the source se and dest se parameters in the '/linkinfo' endpoint until the issue is resolved.