CVE-2025-67081

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing on integer parameter.

• CWE-89

• https://github.com/itflow-org/itflowProduct
• https://www.helx.io/blog/advisory-itflow/Third Party Advisory

Published

Jan 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67073A Buffer overflow vulnerability in function fromAdvSetMacMtu…9.8
• CVE-2025-67074A Buffer overflow vulnerability in function fromAdvSetMacMtu…6.5
• CVE-2025-67076Directory traversal vulnerability in Omnispace Agora Project…7.5
• CVE-2025-67077File upload vulnerability in Omnispace Agora Project before …8.8
• CVE-2025-67078Cross site scripting (XSS) vulnerability in Omnispace Agora …6.1
• CVE-2025-67079File upload vulnerability in Omnispace Agora Project before …9.8
• CVE-2025-67082An SQL injection vulnerability in InvoicePlane through 1.6.3…6.5
• CVE-2025-67083Directory traversal vulnerability in InvoicePlane through 1.…5.3
• CVE-2025-67084File upload vulnerability in InvoicePlane through 1.6.3 allo…9.9
• CVE-2025-67089A command injection vulnerability exists in the GL-iNet GL-A…8.1
• CVE-2025-6709The MongoDB Server is susceptible to a denial of service vul…7.5
• CVE-2025-67090The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6…5.1