Critical severity · published Feb 3, 2026
CVE-2025-57529
YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This allows remote unauthenticated attackers to execute arbitrary SQL commands via crafted input to the parameter. Successful exploitation could lead to unauthorized data access
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cpas Audit Management System · Youdatasum
through 4.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57529
Exploit
https://github.com/songqb-xx/CPAS-bug
Exploit
https://github.com/songqb-xx/CVE-2025-57529/blob/main/README.md
More from Cpas Audit Management System
7.5
CVE-2024-58396
YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId