VYPR
Get started
← All advisories
Medium severity6.7NVD Advisory· Published Mar 20, 2026· Updated Apr 14, 2026

CVE-2025-62846

CVE-2025-62846

Description

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

Affected products

3
  • Qnap/Qurouter3 versions
    cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*
    • cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:*
    • cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.