CVE-2025-67066

Received Received - Intake

SQL Injection in Oasys Sysoa via Outaddresspaging Parameter

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: MITRE

Description

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2025-67066

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a SQL Injection vulnerability in the oasys sysoa software version 1.0. It allows a remote attacker to execute arbitrary code by manipulating the outtype parameter in the /outaddresspaging path.

Impact Analysis

An attacker could exploit this to run malicious SQL commands on the database, potentially stealing, modifying, or deleting sensitive data. This could lead to unauthorized access to user information or system compromise.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face legal penalties, fines, and reputational damage.

Mitigation Strategies

Immediately update oasys sysoa to the latest version to patch the SQL injection flaw in the outtype parameter. If an update is unavailable, restrict access to the /outaddresspaging path and sanitize all user inputs to prevent malicious SQL queries.

Hi! I’m here to help you understand CVE-2025-67066. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70