CVE-2025-14598

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14598", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2025-12-12T17:31:41.755Z", "datePublished": "2026-01-09T12:14:06.932Z", "dateUpdated": "2026-01-09T15:52:06.157Z"}, "containers": {"cna": {"title": "CVE-2025-14598", "descriptions": [{"lang": "en", "value": "BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "BeeS Software Solutions", "product": "BET ePortal", "versions": [{"status": "affected", "version": "0", "lessThan": "ePortal : Secure Build (October 2025)", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "references": [{"url": "https://cloudilyaerp.com/"}, {"url": "https://afnaan.me/cve/cve-2025-14598"}, {"url": "https://github.com/Afnaan-Ahmed/CVE-2025-14598"}], "x_generator": {"engine": "VINCE 3.0.31", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-14598"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-09T12:14:06.932Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/361400"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-09T13:15:54.209Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T15:46:39.443257Z", "id": "CVE-2025-14598", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T15:52:06.157Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.kb.cert.org/vuls/id/361400"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-09T13:15:54.209Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-14598", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-09T15:46:39.443257Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T15:47:25.680Z"}}], "cna": {"title": "CVE-2025-14598", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "BeeS Software Solutions", "product": "BET ePortal", "versions": [{"status": "affected", "version": "0", "lessThan": "ePortal : Secure Build (October 2025)", "versionType": "custom"}]}], "references": [{"url": "https://cloudilyaerp.com/"}, {"url": "https://afnaan.me/cve/cve-2025-14598"}, {"url": "https://github.com/Afnaan-Ahmed/CVE-2025-14598"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.31", "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-14598"}, "descriptions": [{"lang": "en", "value": "BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-01-09T12:14:06.932Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14598", "state": "PUBLISHED", "dateUpdated": "2026-01-09T15:52:06.157Z", "dateReserved": "2025-12-12T17:31:41.755Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-01-09T12:14:06.932Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "BET ePortal", "vendor": "BeeS Software Solutions", "versions": [{"lessThan": "ePortal : Secure Build (October 2025)", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cret@cert.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudilyaerp:bet_e-portal:-:*:*:*:*:*:*:*", "matchCriteriaId": "41BBFEF4-9BC1-4E71-8E91-BF57CCE249D2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database."}, {"lang": "es", "value": "BeeS Software Solutions BET Portal contiene una vulnerabilidad de inyecci\u00f3n SQL en la funcionalidad de inicio de sesi\u00f3n de los sitios afectados. La vulnerabilidad permite la ejecuci\u00f3n de comandos SQL arbitrarios en la base de datos de backend."}], "id": "CVE-2025-14598", "lastModified": "2026-06-17T08:36:14.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14598", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T15:46:39.443257Z", "version": "2.0.3"}}]}, "published": "2026-01-09T13:15:54.990", "references": [{"source": "cret@cert.org", "tags": ["Third Party Advisory"], "url": "https://afnaan.me/cve/cve-2025-14598"}, {"source": "cret@cert.org", "tags": ["Product"], "url": "https://cloudilyaerp.com/"}, {"source": "cret@cert.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Afnaan-Ahmed/CVE-2025-14598"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.kb.cert.org/vuls/id/361400"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}