What is CVE-2025-29980?

CVE-2025-29980 is a critical-severity vulnerability in Centralsquare Etrakit.net, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-03-20.

How severe is CVE-2025-29980?

Critical severity. CVSS v3 base score is 9.8 out of 10.

SQL Injection in Centralsquare Etrakit.net

CVE-2025-29980

A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development.

Vulnerability class: SQL Injection

EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Centralsquare Etrakit.net — versions 3.2.1.77

Weakness classification (CWE)

CWE-89 — SQL Injection

References

9119a7d8-5eab-497f-8521-727c672e3725 (Third Party Advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (Patch)

Frequently asked questions

What is CVE-2025-29980?: CVE-2025-29980 is a critical-severity vulnerability in Centralsquare Etrakit.net, classified under SQL Injection. CVSS score: 9.8/10. Published 2025-03-20.
How severe is CVE-2025-29980?: Critical severity. CVSS v3 base score is 9.8 out of 10.