CVE-2025-10266 CRITICAL

CVE-2025-10266: NewType Infortech｜NUP Portal - SQL Injection

Vendor Newtype Infortech
Product NUP Portal
Weakness CWE-89 · SQLi
Published September 12, 2025
Last update September 12, 2025
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Key dates

02Disclosure timeline

September 12, 2025 CVE published
September 12, 2025 Record updated