CVE-2025-71456 · Other
NO FIX YET · SEE WHAT TO DO
VTENext before 25.02.2 has an SQL injection flaw in the Fax module's EditView.php, reached through a crafted fieldname parameter. An authenticated low-privileged user can read arbitrary database contents, including password reset tokens, and take over other user accounts.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
VTENext installations before 25.02.2 are exposed, and the attacker needs a valid low-privileged account on the CRM. Teams running VTENext for their own staff or customers should look at it; hosted vendors handle the patch themselves. unknown whether other modules are affected.
Not affected if managed-hosting, version-25.02.2-or-later
Who cares crm, php, self-hosted, vtenext
25.02.2 is affected).modules/Fax/EditView.php file is present in the install.25.02.2 or later.vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vte_userauthtoken, to take over other user accounts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.