Area9lyceum Rhapsode vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Area9lyceum Rhapsode: 2 record(s), with affected versions and fixes.cpe:2.3:a:area9lyceum:rhapsode
CVE-2025-67811
Medium · 6.5
CWE-89 Jan 9, 2026
SQL Injection in Area9lyceum Rhapsode
Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.
CVE-2025-67810
Medium · 6.5
CWE-125 Jan 9, 2026
Out-of-bounds Read in Area9lyceum Rhapsode
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.