CVE-2025-10399Korzh EasyQuery Query Builder UI fetch sql injection

5.3MediumCVSS base score
0.26%Exploitation in 30 daysEPSS · top 83% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

A weakness has been identified in Korzh EasyQuery up to 7.4.0. This issue affects some unknown processing of the file /api/easyquery/models/nwind/fetch of the component Query Builder UI. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Timeline

2025
13 Sept 2025
13 Sept 2025
ID reserved
By VulDB
14 Sept 20251 day later
14 Sept 2025· 1 day later
Published
15 Sept 20251 day later
15 Sept 2025· 1 day later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-10399, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Medium6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	3.0	Medium6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
VulDBCNA (assigner)	2.0	Medium6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
NVDNVD · Deferred	4.0	Low2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.26% · top 83% of all CVEs (14 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

Korzh · EasyQuery
- affected 7.0
- affected 7.1
- affected 7.2
- affected 7.3
- affected 7.4.0

References3

VDB-323834 | Korzh EasyQuery Query Builder UI fetch sql injection (opens in a new tab)vdb-entry
VDB-323834 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
Submit #646353 | korzh.com EasyQuery <=7.4.0 SQL Injection (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-10399](https://cveledger.app/badge/CVE-2025-10399.svg)](https://cveledger.app/cve/CVE-2025-10399)

Record last updated 15 Sept 2025, 20:16 UTC.