Read the docs
TI-2025-13343 Aliases CVE-2025-14603GHSA-76p9-g6m2-hj7q

Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.  Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed vsDesk (vsDesk): 14.0101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vsDeskvsDesk11.06.0214.0101Patch availableCNA
  • vsDesk VendorvsDesk Affected 11.06.02 Fixed in 14.0101 Patch available CNA

Remediation

  • Fix · CNA vsDesk (vsDesk) Fixed in 14.0101

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14603
  2. 2026-10-03 Alias added: GHSA-76p9-g6m2-hj7q

References

Other 1

  • TI-2025-13340 Admin Account Takeover via Path Traversal in vsDesk CVSS 4.0CRITICAL 9.3
  • TI-2026-01974 ) Missing Server-Side File Extension Validation in vsDesk CVSS 4.0CRITICAL 9.4
  • TI-2025-13341 vsDesk Task Scheduler OS Command Injection CVSS 4.0HIGH 8.6
  • TI-2025-13342 Weak File Name Generation in vsDesk CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences