CVE-2025-14603
Received Received - Intake

Blind SQL Injection in VSDesk Software

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Kaspersky Labs

Description
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.  Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2025-14603
EUVD
EUVD-2025-210741

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vsdesk application_component From 14.0101 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a blind SQL injection flaw. It occurs when the application processes user-supplied parameters insecurely and passes them directly into SQL queries. An attacker could exploit this to manipulate database queries, potentially accessing or altering sensitive data without proper authorization.

Detection Guidance

Detecting blind SQL injection requires monitoring for unusual database queries or errors. Check application logs for repeated failed queries or time delays in responses. Use tools like SQLMap to test for vulnerabilities by sending crafted inputs and observing responses.

Impact Analysis

Exploitation could lead to unauthorized access to database contents, data leaks, or denial of service where the application becomes unresponsive. Attackers might extract sensitive information, modify records, or disrupt services entirely.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing personal or health data. GDPR mandates protection of personal data, while HIPAA requires safeguarding health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Apply the vendor patch immediately from https://vsdesk.ru/ for versions 14.0101 and above. Ensure all user-supplied parameters are properly sanitized before being used in SQL queries. Review and update database access controls to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart