PT-2026-33991 · Unknown · Zeon Academy Pro

Published 2026-04-21 · Updated 2026-04-21 · CVE-2025-41029

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Zeon Academy Pro (affected versions not specified)

Description An unauthenticated SQL injection allows an attacker to retrieve, create, update, and delete databases. This is achieved by sending a POST request to the endpoint '/private/continue-upload.php' using the phonenumber parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-41029

Affected Products

Zeon Academy Pro

References · 5

• https://incibe.es/en/incibe-cert/notices/aviso/sql-injection-zeon-academy-pro-zeon-global-tech · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-41029 · Security Note
• https://twitter.com/infoflowcloud/status/2046622307980849357 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046614896809246726 · Twitter Post
• https://twitter.com/CVEnew/status/2046620099159715875 · Twitter Post