Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.
References
| Link | Resource |
|---|---|
| https://area9.com | Broken Link |
| https://security.area9lyceum.com/cve-2025-67811/ | Vendor Advisory |
Configurations
History
23 Jan 2026, 15:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://area9.com - Broken Link | |
| References | () https://security.area9lyceum.com/cve-2025-67811/ - Vendor Advisory | |
| CPE | cpe:2.3:a:area9lyceum:rhapsode_learner:1.47.3:*:*:*:*:*:*:* | |
| First Time |
Area9lyceum rhapsode Learner
Area9lyceum |
09 Jan 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
09 Jan 2026, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-09 20:15
Updated : 2026-01-23 15:58
NVD link : CVE-2025-67811
Mitre link : CVE-2025-67811
CVE.ORG link : CVE-2025-67811
JSON object : View
Products Affected
area9lyceum
- rhapsode_learner
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')