CVE-2025-12061
Tax Service Electronic HDM < 1.2.1 - Unauthenticated Arbitrary SQL Execution
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.6EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
26 Nov 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The TAX SERVICE Electronic HDM WordPress plugin before 1.2.1 does not authorization and CSRF checks in an AJAX action, allowing unauthenticated users to import and execute arbitrary SQL statements
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · TAX SERVICE Electronic HDM