PT-2025-41894 · Winsure · Winsure

Published 2025-10-14 · Updated 2025-10-14 · CVE-2025-10610

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Winsure versions through August 21, 2025

Description A flaw exists in Winsure that allows for Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This could allow an attacker to execute arbitrary SQL code within the database backend, potentially leading to full database exfiltration without authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10610

Affected Products

Winsure

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-10610 · Security Note
• https://twitter.com/CveTodo/status/1978090488725901486 · Twitter Post
• https://twitter.com/0dayPublishing/status/1978081920727527854 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978197434497937543 · Twitter Post
• https://usom.gov.tr/bildirim/tr-25-0337 · Note