VYPR
← All advisories
Medium severity6.7NVD Advisory· Published Mar 20, 2026· Updated Jun 17, 2026

CVE-2025-62846

CVE-2025-62846

Description

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands.

We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Qnap/Qurouter4 versions
    cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:qnap:qurouter:2.6.0.239:build_20250625:*:*:*:*:*:*
    • cpe:2.3:o:qnap:qurouter:2.6.0.688:build_20250818:*:*:*:*:*:*
    • cpe:2.3:o:qnap:qurouter:2.6.1.028:build_20251001:*:*:*:*:*:*
    • (no CPE)range: before 2.6.2.007
  • QHora/QHorallm-fuzzy
    Range: before 2.6.2.007

Patches

Vulnerability mechanics

References

1

News mentions

1