Vulnerability-Lookup

CVE-2025-59387 (GCVE-0-2025-59387)

Vulnerability from cvelistv5 – Published: 2026-01-02 15:19 – Updated: 2026-01-05 20:38

Title

MARS (Multi-Application Recovery Service)

Summary

An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS (Multi-Application Recovery Service) 1.2.1.1686 and later

Severity

8.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-05 20:33 UTC

CWE

CWE-89

Assigner

qnap CNA under the mitre root

CNA scorecard B 86/100 over 63 records in the last 180 days details

References

1 reference

URL	Tags
https://www.qnap.com/en/security-advisory/qsa-25-53

Impacted products

1 product

Vendor	Product	Version	CPE status
QNAP Systems Inc.	MARS (Multi-Application Recovery Service)	Affected: 1.2.x , < 1.2.1.1686 (custom)	guessed

Credits

q5ca, greengrass

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:33:39.286309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-05T20:38:38.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MARS (Multi-Application Recovery Service)",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "1.2.1.1686",
              "status": "affected",
              "version": "1.2.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "q5ca, greengrass"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eMARS (Multi-Application Recovery Service) 1.2.1.1686 and later\u003cbr\u003e"
            }
          ],
          "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T15:19:30.445Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "url": "https://www.qnap.com/en/security-advisory/qsa-25-53"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eMARS (Multi-Application Recovery Service) 1.2.1.1686 and later\u003cbr\u003e"
            }
          ],
          "value": "We have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
        }
      ],
      "source": {
        "advisory": "QSA-25-53",
        "discovery": "EXTERNAL"
      },
      "title": "MARS (Multi-Application Recovery Service)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2025-59387",
    "datePublished": "2026-01-02T15:19:30.445Z",
    "dateReserved": "2025-09-15T08:35:00.660Z",
    "dateUpdated": "2026-01-05T20:38:38.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59387",
      "date": "2026-11-01",
      "epss": "0.00375",
      "percentile": "0.3147"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "MARS (Multi-Application Recovery Service)",
                "vendor": "QNAP Systems Inc.",
                "versions": [
                  {
                    "lessThan": "1.2.1.1686",
                    "status": "affected",
                    "version": "1.2.x",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "security@qnapsecurity.com.tw"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de inyecci\u00f3n SQL ha sido reportada que afecta a MARS (Servicio de Recuperaci\u00f3n Multi-Aplicaci\u00f3n). Los atacantes remotos pueden entonces explotar la vulnerabilidad para ejecutar c\u00f3digo o comandos no autorizados.\n\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n:\nMARS (Servicio de Recuperaci\u00f3n Multi-Aplicaci\u00f3n) 1.2.1.1686 y posteriores"
          }
        ],
        "id": "CVE-2025-59387",
        "lastModified": "2026-10-14T19:10:00.297",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "UNREPORTED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@qnapsecurity.com.tw",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-59387",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-05T20:33:39.286309Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-02T16:17:00.293",
        "references": [
          {
            "source": "security@qnapsecurity.com.tw",
            "url": "https://www.qnap.com/en/security-advisory/qsa-25-53"
          }
        ],
        "sourceIdentifier": "security@qnapsecurity.com.tw",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-89"
              }
            ],
            "source": "security@qnapsecurity.com.tw",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-03T15:54:07+00:00",
      "cve": "CVE-2025-59387",
      "id": "CVE-2025-59387",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "MARS (Multi-Application Recovery Service)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-59387.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-59387",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-05T20:33:39.286309Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-05T20:33:39.897Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "MARS (Multi-Application Recovery Service)",
              "vendor": "QNAP Systems Inc.",
              "versions": [
                {
                  "lessThan": "1.2.1.1686",
                  "status": "affected",
                  "version": "1.2.x",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "q5ca, greengrass"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\u003cbr\u003e\u003cbr\u003eWe have already fixed the vulnerability in the following version:\u003cbr\u003eMARS (Multi-Application Recovery Service) 1.2.1.1686 and later\u003cbr\u003e"
                }
              ],
              "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-66",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-66"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "exploitMaturity": "UNREPORTED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-89",
                  "description": "CWE-89",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-02T15:19:30.445Z",
            "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
            "shortName": "qnap"
          },
          "references": [
            {
              "url": "https://www.qnap.com/en/security-advisory/qsa-25-53"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "We have already fixed the vulnerability in the following version:\u003cbr\u003eMARS (Multi-Application Recovery Service) 1.2.1.1686 and later\u003cbr\u003e"
                }
              ],
              "value": "We have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
            }
          ],
          "source": {
            "advisory": "QSA-25-53",
            "discovery": "EXTERNAL"
          },
          "title": "MARS (Multi-Application Recovery Service)",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "assignerShortName": "qnap",
        "cveId": "CVE-2025-59387",
        "datePublished": "2026-01-02T15:19:30.445Z",
        "dateReserved": "2025-09-15T08:35:00.660Z",
        "dateUpdated": "2026-01-05T20:38:38.649Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0003

Vulnerability from certfr_avis - Published: 2026-01-05 - Updated: 2026-01-05

De multiples vulnérabilités ont été découvertes dans les produits Qnap. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Qnap	QVPN	QVPN Device Client pour Mac versions 2.2.x antérieures à 2.2.8
Qnap	QuTS hero	QuTS hero versions h5.2.8.x antérieures à h5.2.8.3321 build 20251117
Qnap	Qfinder	Qfinder Pro Mac versions 7.13.x antérieures à 7.13.0
Qnap	Qsync	Qsync pour Mac versions 5.1.x antérieures à 5.1.5
Qnap	QuMagie	QuMagie versions 2.x antérieures à 2.8.1
Qnap	License Center	License Center versions 2.0.x antérieures à 2.0.36
Qnap	Qfiling	Qfiling versions 3.13.x antérieures à 3.13.1
Qnap	QTS	QTS versions 5.2.8.x antérieures à 5.2.8.3332 build 20251128
Qnap	MARS	MARS (Multi-Application Recovery Service) versions 1.2.x antérieures à 1.2.1.1686
Qnap	QuTS hero	QuTS hero versions h5.3.x antérieures à h5.3.1.3250 build 20250912

References

Title

Publication Time

Tags

Bulletin de sécurité Qnap QSA-25-52	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-51	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-50	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-54	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-55	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-53	2026-01-03	vendor-advisory
Bulletin de sécurité Qnap QSA-25-49	2026-01-03	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "QVPN Device Client pour Mac versions 2.2.x ant\u00e9rieures \u00e0 2.2.8",
      "product": {
        "name": "QVPN",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions h5.2.8.x ant\u00e9rieures \u00e0 h5.2.8.3321 build 20251117",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qfinder Pro Mac versions 7.13.x ant\u00e9rieures \u00e0 7.13.0",
      "product": {
        "name": "Qfinder",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qsync pour Mac versions 5.1.x ant\u00e9rieures \u00e0 5.1.5",
      "product": {
        "name": "Qsync",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuMagie versions 2.x ant\u00e9rieures \u00e0 2.8.1",
      "product": {
        "name": "QuMagie",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "License Center versions 2.0.x ant\u00e9rieures \u00e0 2.0.36",
      "product": {
        "name": "License Center",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "Qfiling versions 3.13.x ant\u00e9rieures \u00e0 3.13.1",
      "product": {
        "name": "Qfiling",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QTS versions 5.2.8.x ant\u00e9rieures \u00e0 5.2.8.3332 build 20251128",
      "product": {
        "name": "QTS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "MARS (Multi-Application Recovery Service) versions 1.2.x ant\u00e9rieures \u00e0 1.2.1.1686",
      "product": {
        "name": "MARS",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    },
    {
      "description": "QuTS hero versions h5.3.x ant\u00e9rieures \u00e0 h5.3.1.3250 build 20250912",
      "product": {
        "name": "QuTS hero",
        "vendor": {
          "name": "Qnap",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-53590",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53590"
    },
    {
      "name": "CVE-2025-52431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52431"
    },
    {
      "name": "CVE-2025-52864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52864"
    },
    {
      "name": "CVE-2025-54165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54165"
    },
    {
      "name": "CVE-2025-59381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59381"
    },
    {
      "name": "CVE-2025-54164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54164"
    },
    {
      "name": "CVE-2025-53414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53414"
    },
    {
      "name": "CVE-2025-53589",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53589"
    },
    {
      "name": "CVE-2025-48721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48721"
    },
    {
      "name": "CVE-2025-53597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53597"
    },
    {
      "name": "CVE-2025-53405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53405"
    },
    {
      "name": "CVE-2025-57705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-57705"
    },
    {
      "name": "CVE-2025-53596",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53596"
    },
    {
      "name": "CVE-2025-53594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53594"
    },
    {
      "name": "CVE-2025-9110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-9110"
    },
    {
      "name": "CVE-2025-52426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52426"
    },
    {
      "name": "CVE-2025-62852",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-62852"
    },
    {
      "name": "CVE-2025-53593",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53593"
    },
    {
      "name": "CVE-2025-53592",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53592"
    },
    {
      "name": "CVE-2025-52872",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52872"
    },
    {
      "name": "CVE-2025-59380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59380"
    },
    {
      "name": "CVE-2025-52863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52863"
    },
    {
      "name": "CVE-2025-44013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-44013"
    },
    {
      "name": "CVE-2025-52871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52871"
    },
    {
      "name": "CVE-2025-54166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-54166"
    },
    {
      "name": "CVE-2025-52430",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-52430"
    },
    {
      "name": "CVE-2025-59384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59384"
    },
    {
      "name": "CVE-2025-47208",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-47208"
    },
    {
      "name": "CVE-2025-62857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-62857"
    },
    {
      "name": "CVE-2025-53591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53591"
    },
    {
      "name": "CVE-2025-59387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-59387"
    }
  ],
  "initial_release_date": "2026-01-05T00:00:00",
  "last_revision_date": "2026-01-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0003",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-01-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Qnap. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Qnap",
  "vendor_advisories": [
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-52",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-52"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-51",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-51"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-50",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-50"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-54",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-54"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-55",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-55"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-53",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-53"
    },
    {
      "published_at": "2026-01-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Qnap QSA-25-49",
      "url": "https://www.qnap.com/go/security-advisory/qsa-25-49"
    }
  ]
}

FKIE_CVE-2025-59387

Vulnerability from fkie_nvd - Published: 2026-01-02 16:17 - Updated: 2026-10-14 19:10

Severity

8.1 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Summary

References

	URL	Tags
	security@qnapsecurity.com.tw	https://www.qnap.com/en/security-advisory/qsa-25-53

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "MARS (Multi-Application Recovery Service)",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "1.2.1.1686",
              "status": "affected",
              "version": "1.2.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@qnapsecurity.com.tw"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later"
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n SQL ha sido reportada que afecta a MARS (Servicio de Recuperaci\u00f3n Multi-Aplicaci\u00f3n). Los atacantes remotos pueden entonces explotar la vulnerabilidad para ejecutar c\u00f3digo o comandos no autorizados.\n\nYa hemos corregido la vulnerabilidad en la siguiente versi\u00f3n:\nMARS (Servicio de Recuperaci\u00f3n Multi-Aplicaci\u00f3n) 1.2.1.1686 y posteriores"
    }
  ],
  "id": "CVE-2025-59387",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@qnapsecurity.com.tw",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59387",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-05T20:33:39.286309Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-02T16:17:00.293",
  "references": [
    {
      "source": "security@qnapsecurity.com.tw",
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-53"
    }
  ],
  "sourceIdentifier": "security@qnapsecurity.com.tw",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security@qnapsecurity.com.tw",
      "type": "Secondary"
    }
  ]
}

GHSA-P5Q4-3RV5-J9HJ

Vulnerability from github – Published: 2026-01-02 18:30 – Updated: 2026-01-02 18:30

Details

An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: MARS (Multi-Application Recovery Service) 1.2.1.1686 and later

Severity

8.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-59387"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-02T16:17:00Z",
    "severity": "HIGH"
  },
  "details": "An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands.\n\nWe have already fixed the vulnerability in the following version:\nMARS (Multi-Application Recovery Service) 1.2.1.1686 and later",
  "id": "GHSA-p5q4-3rv5-j9hj",
  "modified": "2026-01-02T18:30:31Z",
  "published": "2026-01-02T18:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59387"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/qsa-25-53"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-59387 (GCVE-0-2025-59387)

CERTFR-2026-AVI-0003

Solutions

FKIE_CVE-2025-59387

GHSA-P5Q4-3RV5-J9HJ

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour