PT-2025-46694 · Wellsky · Wellsky Harmony

Published 2025-11-12 · Updated 2025-12-31 · CVE-2025-56385

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WellSky Harmony version 4.1.0.2.83

Description A SQL injection issue exists in the login functionality of WellSky Harmony. The 'xmHarmony.asp' endpoint is affected, specifically due to insufficient sanitization of user-supplied input provided through the TXTUSERID parameter. Successful exploitation could lead to authentication bypass, data leakage, or complete compromise of the backend database.

Recommendations Apply proper input sanitization to the TXTUSERID parameter within the 'xmHarmony.asp' endpoint.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-56385

Affected Products

Wellsky Harmony

References · 7

• https://osv.dev/vulnerability/CVE-2025-56385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56385 · Security Note
• https://twitter.com/CVEnew/status/1988721789875225082 · Twitter Post
• https://machevalia.blog/blog/cve-2025-56385-wellsky-harmony-sql-injection · Note
• https://t.me/cveNotify/147338 · Telegram Post
• http://harmony.com · Note
• http://wellsky.com · Note