PT-2026-26636 · Qhora · Qhora

CVE-2025-62846 · Publicado 2026-03-20 · Atualizado 2026-03-30

Positive Technologies (AI Summary)

CVSS v4.0

7.3

Alta

Vetor base

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U

Name of the Vulnerable Software and Affected Versions QHora versions prior to 2.6.2.007

Description An SQL injection issue exists in QHora. A local attacker with administrator privileges can exploit this to execute unauthorized code or commands. The vulnerability allows for the execution of arbitrary code or commands.

Recommendations Update to QHora version 2.6.2.007 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2025-62846

ZDI-26-241

Produtos afetados

Qhora

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-62846 · Nota de Segurança
• https://qnap.com/en/security-advisory/qsa-26-12 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2035621555330302186 · Publicação no Twitter
• https://twitter.com/TweetThreatNews/status/2036105717338304576 · Publicação no Twitter
• https://twitter.com/HostingTechNet/status/2038190064904163801 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2035619795505479688 · Publicação no Twitter
• https://zerodayinitiative.com/advisories/ZDI-26-241 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2035079629694726167 · Publicação no Twitter