PT-2025-40603 · Anyquery · Anyquery

Keremergur · Published 2025-10-03 · Updated 2025-10-04 · CVE-2025-61679

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Anyquery versions 0.4.3 and below

Description Anyquery is an SQL query engine built on top of SQLite. Attackers who have gained access to localhost, even with low privileges, can use the http server through the port unauthenticated and access private integration data, such as emails, without any warning of a foreign login from the provider. The issue affects versions running prior to 0.4.4.

Recommendations Update to version 0.4.4 or later.

Exploit

Fix

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-287

CWE-200

Related Identifiers

CVE-2025-61679

GHSA-5F7P-RHMQ-HVC7

Affected Products

Anyquery

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61679.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61679 · Security Note
• https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7 · Note
• https://github.com/julien040/anyquery/releases/tag/0.4.4 · Note
• https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3 · Note
• https://t.me/cveNotify/137376 · Telegram Post
• https://t.me/CVEtracker/34066 · Telegram Post
• https://twitter.com/CVEnew/status/1974227108701274495 · Twitter Post
• https://twitter.com/offseq/status/1974377137084784899 · Twitter Post