{"id":"CVE-2025-48701","details":"openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.","modified":"2026-08-12T03:51:18.259486005Z","published":"2025-05-23T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48701.json","cna_assigner":"mitre","cwe_ids":["CWE-89"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48701.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48701"},{"type":"REPORT","url":"https://github.com/opendcim/openDCIM/issues/1601"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/opendcim/opendcim","events":[{"introduced":"0"},{"fixed":"5e24d4c5daff7f3db12a90594b9ad56e136fc374"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"23.04"},{"fixed":"23.04"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["23.03","23.02","23.01","openDCIM-21.01","21.01","20.02","19.01","18.02","openDCIM-18.01","18.01","4.5","4.4","4.3.1","4.3","4.2","4.2-Release","4.1","4.0.1","v4.0a","v4.0","4.0-beta.2","4.0-beta.1","3.3","3.2.1","3.2","3.1","3.0","2.1","2.1-RC0","2.0.2","2.0.1","2.0","openDCIM-2.0-RC0","openDCIM-1.5.2","openDCIM-1.5.1","openDCIM-1.5","openDICM-1.4","openDCIM-1.3","1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48701.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}