CVE-2025-14603: Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

Q: Which installations need remediation?

vsDesk versions earlier than 14.0101 need remediation. Versions 14.0101 and later include the vendor patch.

Q: What could exploitation allow an attacker to do?

The issue can enable blind SQL injection through insecure handling of user-supplied parameters. This may expose database contents or cause the application to become unresponsive.

Q: What should be done if the affected version is deployed?

Apply the vendor patch by upgrading to vsDesk version 14.0101 or later.

Published Aug 19, 2026

Updated

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

Affected Software

1 affected component

vsDesk.ru vsDesk<14.0101

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade vsDesk to a version that resolves this vulnerability.
Fixed in 14.0101

Event History

Aug 19, 2026

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

DescriptionWeakness

Frequently Asked Questions

Which installations need remediation?

vsDesk versions earlier than 14.0101 need remediation. Versions 14.0101 and later include the vendor patch.

What could exploitation allow an attacker to do?

The issue can enable blind SQL injection through insecure handling of user-supplied parameters. This may expose database contents or cause the application to become unresponsive.

What should be done if the affected version is deployed?