VulnerabilityAnalyzed
CVE-2025-26086
An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler.
HIGH 7.5EPSS 14.1%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
An unauthenticated blind SQL injection vulnerability exists in RSI Queue Management System v3.0 within the TaskID parameter of the get request handler. Attackers can remotely inject time-delayed SQL payloads to induce server response delays, enabling time-based inference and iterative extraction of sensitive database contents without authentication.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 14.10% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- rsiqueue/management system
- Source
- cve@mitre.org
References
- https://seclists.org/fulldisclosure/2025/May/21Mailing List
- http://seclists.org/fulldisclosure/2025/May/21Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.