PT-2026-1884 · Area9 · Area9 Rhapsode

Published 2026-01-09 · Updated 2026-02-10 · CVE-2025-67811

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Area9 Rhapsode version 1.47.3

Description Area9 Rhapsode version 1.47.3 is susceptible to SQL Injection through multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, potentially leading to unauthorized database access and compromise of sensitive data. The API endpoints are vulnerable to injection attacks due to inadequate sanitization of user-supplied input. The vulnerable parameters or variables are not specified.

Recommendations Update Area9 Rhapsode to version 1.47.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67811

Affected Products

Area9 Rhapsode

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-67811 · Security Note
• https://security.area9lyceum.com/cve-2025-67811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67811 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2009861598043632104 · Twitter Post
• https://t.me/cveNotify/149709 · Telegram Post
• https://twitter.com/CVEnew/status/2009711961529881006 · Twitter Post
• https://t.me/cveNotify/151623 · Telegram Post
• https://t.me/CVEtracker/41873 · Telegram Post
• https://area9.com · Note