CVE-2025-3707 MEDIUM

CVE-2025-3707: Sunnet eHRD CTMS - SQL Injection

Vendor Sunnet

Product eHRD CTMS

Weakness CWE-89 · SQLi

Published May 2, 2025

Last update May 2, 2025

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents.

Key dates

02Disclosure timeline

May 2, 2025 CVE published

May 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-3707 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-31212 SQL injection in index_chart_data action CVE-2025-2117 Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System reportCenter.do electricDocList sql injection CVE-2025-68017 WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability CVE-2017-17423 CVE-2025-0540 itsourcecode Tailoring Management System expadd.php sql injection