CVE-2025-50983
SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint...
Basic Information
- CVE State
- PUBLISHED
- Reserved Date
- June 16, 2025
- Published Date
- August 27, 2025
- Last Updated
- August 27, 2025
- Vendor
- n/a
- Product
- n/a
- Description
- SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. The endpoint fails to properly sanitize user-supplied input, allowing attackers to inject and execute arbitrary SQL commands against the backend SQLite database. Sqlmap confirmed exploitation via stacked queries, demonstrating that the parameter can be abused to run arbitrary SQL statements. A heavy query was executed using SQLite's RANDOMBLOB() and HEX() functions to simulate a time-based payload, indicating deep control over database interactions.
CVSS Scores
CVSS v3.1
8.3 - HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
SSVC Information
- Exploitation
- poc
- Technical Impact
- partial
Exploit Status
- Exploited in the Wild
- Yes (2026-06-01 10:39:41 UTC) Source
Known Exploited Vulnerability Information
| Source | Added Date |
|---|---|
| CVE | 2026-06-01 10:39:41 UTC |
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel