CVE-2025-67805
HIGH EPSS 20.4%
Published Apr 1, 20263mo ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
Published Apr 1, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago
Description
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 2025_06_003.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
20.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 2
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-306 Missing Authentication for Critical Function Authentication
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| sagedpw | sage_dpw | 2025_06_004 | any |
References 2
- pastebin.com https://pastebin.com/Tk4LgMG2
- sagedpw.at https://www.sagedpw.at/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.