CVE-2025-8124

🗓️ 24 Jul 2025 23:32:09Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 12 Views🌐 WEB

Critical SQL injection vulnerability in deerwms deer-wms-2 up to 3.3, affecting unallocatedList function

Reporter	Title	Published	Views	Family All 8
CNNVD	deer-wms-2 SQL注入漏洞	25 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-8124 deerwms deer-wms-2 unallocatedList sql injection	24 Jul 202523:32	–	cvelist
EUVD	EUVD-2025-22559	3 Oct 202520:07	–	euvd
NVD	CVE-2025-8124	25 Jul 202500:15	–	nvd
OSV	CVE-2025-8124	25 Jul 202500:15	–	osv
Positive Technologies	PT-2025-30710 · Unknown · Deerwms Deer-Wms-2	24 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-8124	27 Jul 202500:19	–	redhatcve
Vulnrichment	CVE-2025-8124 deerwms deer-wms-2 unallocatedList sql injection	24 Jul 202523:32	–	vulnrichment

NVD

Vulners

Node

deerwms deer-wms-2Range≤3.3

[
  {
    "vendor": "deerwms",
    "product": "deer-wms-2",
    "versions": [
      {
        "version": "3.0",
        "status": "affected"
      },
      {
        "version": "3.1",
        "status": "affected"
      },
      {
        "version": "3.2",
        "status": "affected"
      },
      {
        "version": "3.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
gitee	www.gitee.com/deerwms/deer-wms-2/issues/ICLRF0
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
params[dataScope]	request body	/system/role/authUser/unallocatedList	SQL injection via params[dataScope] in unallocatedList adds unsafeguarded user input into SQL query	CWE-74, CWE-89

29 Apr 2026 01:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.3 - 8.8

CVSS 45.3

CVSS 26.5

CVSS 36.3

EPSS0.00223

SSVC