TI-2025-00562 Aliases CVE-2025-0668 GHSA-j6c5-42fq-c3hr

BOINC Server Multiple SQL Injections

MEDIUM 49CWE-89Published 2025-05-07 · Updated 2025-05-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: before 1.4.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00609 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed BOINC Server (BOINC): 1.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BOINC	BOINC Server	before 1.4.5	1.4.5	Patch available	CNA

BOINC Server VendorBOINC Affected before 1.4.5 Fixed in 1.4.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:universityofcalifornia:boinc_server::::::::	before 1.4.5	Vulnerable	BOINC

cpe:2.3:a:universityofcalifornia:boinc_server:*:*:*:*:*:*:*:* Versions before 1.4.5 Vulnerable ·BOINC

Remediation

Fix · CNA BOINC Server (BOINC) Fixed in 1.4.5

Timeline

2026-10-02 Threatist record created from CVE-2025-0668
2026-10-03 Alias added: GHSA-j6c5-42fq-c3hr

References

Exploit 1

https://www.compass-security.com/fileadmin/Research/Advisories/2025_03_CSNC-2025-004_BOINC_multiple_SQLi.txt

TI-2025-00561 BOINC Server Stored XSS Injection in pm.php CVSS 4.0HIGH 8.7
TI-2025-00563 BOINC Server Cross-Site Request Forgery CVSS 4.0HIGH 8.6
TI-2025-00560 BOINC Server Stored XSS Injection in host_venue_action.php CVSS 4.0HIGH 7.0
TI-2018-16094 Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences