High severity · published Oct 3, 2025
CVE-2025-61679
Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data
7.7
CVSS
0.2%
EPSS
No
On KEV
Description
Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
anyquery · julien040
< 0.4.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61679
github.com
https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3
github.com
https://github.com/julien040/anyquery/releases/tag/0.4.4
github.com
https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7
More from anyquery
9.1
CVE-2026-50006
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
9.0
CVE-2026-47252
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS plugins (Brave, Chrome, Edge, Reminders, Safari)
8.6
CVE-2026-54628
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
7.5
CVE-2026-54629
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
7.3
CVE-2026-47253
Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion