CVE-2025-68393: SQL Injection in Protectel

Published Oct 30, 2026

Updated

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ARKETEAM Protectel PROTECTELMAJ to a version that resolves this vulnerability.
Fixed in 6.5.19
Upgrade
Upgrade ARKETEAM Protectel BDF to a version that resolves this vulnerability.
Fixed in 6.4.67

Event History

Oct 30, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

DescriptionWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using the PROTECTELMAJ or BDF modules are affected if they are below PROTECTELMAJ v6.5.19 or BDF v6.4.67, respectively. The issue is fixed in those versions.

What access does an attacker need?

An attacker needs low-privileged access and the ability to supply input to the "Utilisateur" parameter. No user interaction is required.

What is the likely impact of successful exploitation?

Successful SQL injection can affect confidentiality and integrity at a high level, with a lower impact on availability according to the supplied severity vector.