PT-2025-33814 · Unknown · Smartlibrary+1

Published 2025-08-19 · Updated 2025-10-07 · CVE-2025-51506

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: HRForecast Suite versions 0.4.3

Description: A SQL injection flaw exists in the smartLibrary component. This allows any authenticated user to execute arbitrary SQL queries through crafted payloads to the valueKey parameter. The vulnerability is located in the /api/smartlibrary/v2/en/dictionaries/options/lookup API endpoint.

Recommendations: Apply input validation and sanitization to the valueKey parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-51506

Affected Products

Hrforecast Suite

Smartlibrary

References · 8

• 🔥 https://github.com/MVRC-ITSEC/CVEs/blob/main/CVE-2025-51506 · Exploit
• https://osv.dev/vulnerability/CVE-2025-51506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51506 · Security Note
• https://t.me/cveNotify/137738 · Telegram Post
• https://twitter.com/CVEnew/status/1957854182079393808 · Twitter Post
• https://hrforecast.com/smartlibrary-job-architecture · Note
• https://hrforecast.com · Note
• https://twitter.com/VulmonFeeds/status/1957907895644725676 · Twitter Post