VULNERABILITY INTELLIGENCE
CVE-2025-34179
EPSS probability0.40%
CISA KEVNot currently listed
Published2025-12-15
Last modified2026-10-23
Description
NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server evaluates request URIs using an unsanitized SQLite query against the FileLinks table in gateway.db. By injecting SQL through the LinkName/URI value, a remote attacker can control the FileName field used by the server to read and return files from disk, resulting in arbitrary local file disclosure.
Weakness classification
- disclosure@vulncheck.com: CWE-89