CVE-2025-55476

MEDIUM EPSS 14.8%
Published Sep 2, 202510mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Sep 2, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

FireShare FileShare 1.2.25 contains a time-based blind SQL injection vulnerability in the sort parameter of the endpoint: GET /api/videos/public?sort= This parameter is unsafely evaluated in a SQL ORDER BY clause without proper sanitization, allowing an attacker to inject arbitrary SQL subqueries.

CVSS Details

Base Score
6.5
Exploitability
3.9
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
14.8% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 1

VendorProductVersionRange
shaneisraelfireshare1.2.25any

References 3

  • cyber-ducky.com https://cyber-ducky.com/blind-sql-injection-in-fireshare-found-in-an-api-sort-parameter/
    ExploitThird Party Advisory
  • github.com https://github.com/ShaneIsrael/fireshare/issues/311
    ExploitIssue Tracking
  • github.com https://github.com/ShaneIsrael/fireshare/releases/tag/v1.2.26
    Release Notes

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.