CVE-2025-15107

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report and is planning to fix this flaw in an upcoming release.

• CWE-320
• CWE-321
• CWE-798

• https://github.com/actiontech/sqle/issues/3186Exploit, Third Party Advisory
• https://github.com/actiontech/sqle/milestone/53Exploit
• https://vuldb.com/?ctiid.338478Permissions Required, VDB Entry
• https://vuldb.com/?id.338478Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.710380Third Party Advisory, VDB Entry

Published

Dec 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-15101An OS command injection vulnerability in the web management …8.8
• CVE-2025-15102DVP-12SE11T - Password Protection Bypass9.8
• CVE-2025-15103DVP-12SE11T - Authentication Bypass via Partial Password Dis…9.8
• CVE-2025-15104Nu Html Checker (validator.nu) contains a restriction bypass…5.3
• CVE-2025-15105A security flaw has been discovered in getmaxun maxun up to …5.9
• CVE-2025-15106A weakness has been identified in getmaxun maxun up to 0.0.2…4.3
• CVE-2025-15108A vulnerability was detected in PandaXGO PandaX up to fb8ff4…3.7
• CVE-2025-15109A flaw has been found in jackq XCMS up to 3fab5342cc509945a7…7.3
• CVE-2025-1511The User Registration & Membership – Custom Registration For…6.1
• CVE-2025-15110A vulnerability has been found in jackq XCMS up to 3fab5342c…7.2
• CVE-2025-15111Ksenia Security lares (legacy model) version 1.6 contains a …9.8
• CVE-2025-15112Ksenia Security lares (legacy model) version 1.6 contains a …5.4