SQL Injection Vulnerability in SUNNET Corporate Training Management System
CVE-2025-54946

9.3CRITICAL

Key Information:

Vendor

Sunnet Technology Co., Ltd.

Status
Corporate Training Management System
Vendor
CVE Published:
30 August 2025

What is CVE-2025-54946?

A SQL injection vulnerability exists in the SUNNET Corporate Training Management System prior to version 10.11, enabling remote attackers to manipulate the database through crafted SQL queries. This vulnerability allows unauthorized users to execute arbitrary SQL commands, potentially leading to data exposure, modification, or deletion. Organizations using this software are advised to upgrade to the latest version to mitigate risks associated with this security flaw.

Affected Version(s)

Corporate Training Management System 0

References

https://zuso.ai/advisory/
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54946 : SQL Injection Vulnerability in SUNNET Corporate Training Management System