CVE-2025-61679

Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data

CVSS 7.7 HIGHEPSS 0.1%CWE-200 CWE-287

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

03 Oct 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained access to localhost, even with low privileges, to use the http server through the port unauthenticated, and access private integration data like emails, without any warning of a foreign login from the provider. This issue is fixed in version 0.4.4.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

julien040 · anyquery

References

https://github.com/julien040/anyquery/commit/43cd8bd3354b9725b245a2354b08e1c9be1cc1d3 https://github.com/julien040/anyquery/releases/tag/0.4.4 https://github.com/julien040/anyquery/security/advisories/GHSA-5f7p-rhmq-hvc7