SQL Injection in QNAP Systems Inc. Mars (Multi-Application Recovery Service)
CVE-2025-59387
An SQL injection vulnerability has been reported to affect MARS (Multi-Application Recovery Service). The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS (Multi-Application Recovery Service) 1.2.1.1686 and later
Vulnerability class: SQL Injection
EPSS: 0.003 (27.1th percentile) — read the EPSS interpretation.
Affected products
- Qnap Systems Inc. Mars (Multi-application Recovery Service) — versions 1.2.x