PT-2026-1099 · Mars · Mars

Greengrass + 1 · Published 2026-01-02 · Updated 2026-01-06 · CVE-2025-59387

Positive Technologies (AI Summary)

CVSS v4.0

8.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions MARS (Multi-Application Recovery Service) versions prior to 1.2.1.1686

Description An SQL injection issue affects MARS (Multi-Application Recovery Service). Successful exploitation could allow remote attackers to execute unauthorized code or commands. It is estimated that over 3.25 million instances are exposed. The vulnerability allows attackers to potentially execute unauthorized code or commands through SQL injection. The API endpoints and vulnerable parameters are not specified.

Recommendations Update MARS (Multi-Application Recovery Service) to version 1.2.1.1686 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-59387

Affected Products

Mars

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-59387 · Security Note
• https://twitter.com/CVEnew/status/2007118416415690758 · Twitter Post
• https://t.me/CVEtracker/41254 · Telegram Post
• https://qnap.com/en/security-advisory/qsa-25-53 · Note
• https://twitter.com/zoomeye_team/status/2008475705252937980 · Twitter Post