CVE Intelligence

Area9lyceum vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Area9lyceum products: 2 record(s), with severity, exploitation and fixes.

Rhapsode 2

Exploited only (KEV) →

CVE-2025-67811 Medium · 6.5 CWE-89 Jan 9, 2026
SQL Injection in Area9lyceum Rhapsode
Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers to inject arbitrary SQL commands, resulting in unauthorized database access and potential compromise of sensitive data. Fixed in v.1.47.4 and beyond.
CVE-2025-67810 Medium · 6.5 CWE-125 Jan 9, 2026
Out-of-bounds Read in Area9lyceum Rhapsode
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions.