CVE-2025-5493

A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file /e3api/api/main/ToJsonByControlName. The manipulation of the argument data leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-74
• CWE-89
• CWE-89

• https://medium.com/@luoluoxi311/sql-injection-in-baison-channel-middleware-product-version-2-0-1-e0d1ec95c697Exploit, Third Party Advisory
• https://vuldb.com/?ctiid.310910Permissions Required, VDB Entry
• https://vuldb.com/?id.310910Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.586972Third Party Advisory, VDB Entry
• https://medium.com/@luoluoxi311/sql-injection-in-baison-channel-middleware-product-version-2-0-1-e0d1ec95c697Exploit, Third Party Advisory

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-54920This issue affects Apache Spark: before 3.5.7 and 4.0.1. Use…8.8
• CVE-2025-54923CWE-502: Deserialization of Untrusted Data vulnerability exi…8.7
• CVE-2025-54924CWE-918: Server-Side Request Forgery (SSRF) vulnerability ex…7.5
• CVE-2025-54925CWE-918: Server-Side Request Forgery (SSRF) vulnerability ex…7.5
• CVE-2025-54926CWE-22: Improper Limitation of a Pathname to a Restricted Di…7.2
• CVE-2025-54927CWE-22: Improper Limitation of a Pathname to a Restricted Di…4.9
• CVE-2025-54939LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_e…7.5
• CVE-2025-5494ZohoCorp ManageEngine Endpoint Central was impacted by an im…7.8
• CVE-2025-54940An HTML injection vulnerability exists in WordPress plugin "…4.6
• CVE-2025-54941An example dag `example_dag_decorator` had non-validated par…4.6
• CVE-2025-54942A missing authentication for critical function vulnerability…9.8
• CVE-2025-54943A missing authorization vulnerability in SUNNET Corporate Tr…9.8