CVE-2025-71456: vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView
Published Nov 4, 2026
·Updated
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in vteuserauthtoken, to take over other user accounts.
Event History
Nov 4, 2026
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require administrative access?
No. The vulnerability is reported as exploitable by authenticated low-privileged users through a crafted fieldname parameter.
2
Which systems should be prioritized for remediation?
Prioritize vtenext installations running versions before 25.02.2, especially where low-privileged authenticated accounts can access the Fax edit view functionality.