CVE-2025-51683

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 2.00%
EPSS Percentile: 80.42%
CISA KEV: Not listed

Description

A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cve@mitre.org
Published: 02-Dec-2025 03:15
Last Modified: 05-Jul-2026 09:16
EPSS Date: 2026-10-16
CWE: CWE-89

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

mjobtime / mjobtime
Version / affected range: 15.7.2
cpe:2.3:a:mjobtime:mjobtime:15.7.2:*:*:*:*:*:*:*

References

cve@mitre.org

Last enrichment sync: 17-Oct-2026 12:34
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

A blind SQL injection vulnerability in version 15.7.2 of the Mjobtime app was identified, researched, and documented by Dario Wiess of InfoGuard Labs, with CVE-2025-51683 being assigned based on Dario’s efforts. Huntress Reports Exploitation of Mjobtime SQL Injection Vulnerability

People (1)

MITRE ATT&CK (2)

Products (4)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.