Platform
other
Component
nup-portal
Fixed in
5.0.1
CVE-2025-10266 describes a critical SQL Injection vulnerability discovered in the NUP Portal developed by NewType Infortech. This vulnerability allows unauthenticated remote attackers to inject arbitrary SQL commands, leading to unauthorized access and manipulation of sensitive data. Versions 0 through SP5.0 are affected. A patch is available in version 5.0.1.
The impact of this SQL Injection vulnerability is severe. An attacker could leverage it to bypass authentication and gain complete control over the NUP Portal's database. This includes the ability to read confidential user data (usernames, passwords, personal information), modify critical system configurations, and even delete entire database tables. Successful exploitation could lead to a complete compromise of the system and significant data loss. The potential for lateral movement within the network depends on the database's permissions and connectivity to other systems, but the initial breach point is highly impactful.
CVE-2025-10266 has been publicly disclosed and assigned a CRITICAL CVSS score of 9.8. While no public proof-of-concept (PoC) code has been released at the time of writing, the ease of SQL Injection exploitation suggests a high probability of exploitation. The vulnerability is not currently listed on the CISA KEV catalog. Active campaigns targeting this vulnerability are not yet confirmed, but the severity warrants immediate attention and proactive security measures.
Exploit Status
EPSS
0.12% (32% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-10266 is to immediately upgrade the NUP Portal to version 5.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or downtime concerns, consider implementing temporary workarounds. These may include restricting network access to the NUP Portal, implementing strict input validation on all user-supplied data, and deploying a Web Application Firewall (WAF) with SQL Injection protection rules. Regularly review database user permissions to minimize the potential damage from a successful attack. After upgrading, confirm the vulnerability is resolved by attempting a SQL Injection attack on a non-critical endpoint.
Update NUP Portal to a version later than SP5.0 that fixes the SQL Injection (SQL Injection) vulnerability. Refer to the vendor's website, NewType Infortech, for the latest version and update instructions. Apply security updates as soon as they are available.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-10266 is a critical SQL Injection vulnerability affecting NUP Portal versions 0–SP5.0, allowing attackers to manipulate the database.
If you are using NUP Portal versions 0 through SP5.0, you are vulnerable. Upgrade to version 5.0.1 or later to mitigate the risk.
The recommended fix is to upgrade to version 5.0.1 or later. If immediate upgrade is not possible, implement temporary workarounds like WAF rules and input validation.
While no active campaigns are confirmed, the vulnerability's severity suggests a high probability of exploitation. Proactive mitigation is crucial.
Refer to the NewType Infortech website or security advisories for the official advisory regarding CVE-2025-10266.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.