PT-2025-48270 · Devolutions · Devolutions Server

Published 2025-11-27 · Updated 2026-01-05 · CVE-2025-13757

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Devolutions Server versions through 2025.2.20 and through 2025.3.8

Description Devolutions Server is affected by a SQL Injection issue within the last usage logs functionality. The flaw allows authenticated attackers to potentially steal all stored passwords from the database. The issue enables data exfiltration from the database through a critical SQL injection vulnerability.

Recommendations Devolutions Server versions prior to 2025.2.21 should be updated. Devolutions Server versions prior to 2025.3.9 should be updated.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-15266

CVE-2025-13757

Affected Products

Devolutions Server

References · 19

• https://bdu.fstec.ru/vul/2025-15266 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-13757 · Security Note
• https://devolutions.net/security/advisories/DEVO-2025-0018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13757 · Vendor Advisory
• https://twitter.com/PurpleOps_io/status/1995402881369849934 · Twitter Post
• https://twitter.com/fridaysecurity/status/1995292383404257346 · Twitter Post
• https://t.me/cveNotify/144617 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1995613361954795788 · Twitter Post
• https://twitter.com/PurpleOps_io/status/1995387998301466974 · Twitter Post
• https://t.me/CVEtracker/38394 · Telegram Post
• https://t.me/pentestingnews/71309 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1995777972381388918 · Twitter Post
• https://twitter.com/CCBalert/status/1994361366883258387 · Twitter Post
• https://twitter.com/CVEnew/status/1994071703685648537 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1994085528874975684 · Twitter Post