PT-2026-29528 · Sage · Sage Dpw

Published 2026-04-01 · Updated 2026-04-01 · CVE-2025-67805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sage DPW version 2025 06 004

Description A non-default configuration allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud.

Recommendations Disable the Database Monitor feature.

Fix

Information Disclosure

Missing Authentication

Weakness Enumeration

CWE-200

CWE-306

Related Identifiers

CVE-2025-67805

Affected Products

Sage Dpw

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-67805 · Security Note
• https://sagedpw.at · Note
• https://twitter.com/CVEnew/status/2039372071843598390 · Twitter Post
• https://pastebin.com/Tk4LgMG2 · Note