CVE-2025-51683
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A blind SQL injection vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint.
Risk Assessment
An attacker can read, modify, or delete database records, compromising the confidentiality and integrity of organizational data.
Recommendation
Immediately update mJobtime to the latest patched version and enforce parameterized SQL queries in the application.
Other vulnerabilities in mJobtime
See all- CVE-2026-9209Critical
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.
- CVE-2025-51682Critical
The vulnerability in mJobtime 15.7.2 handles authorization on the client side, allowing an attacker to modify client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative functions directly.
Original NVD description (English source)
A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .
Vulnerability data from NVD (NIST) · CISA KEV · EPSS