CVE-2025-8052

Description

SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor. This issue affects Flipper: 3.1.2.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-564 CWE-564

Affected Products

Vendor	Product	Versions
opentext	flipper	All

References

Advisories & Patches

https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0850533

Frequently Asked Questions

What is CVE-2025-8052? +

SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor. This issue affects Flipper: 3.1.2. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2025-8052? +

CVE-2025-8052 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-8052? +

CVE-2025-8052 affects products from opentext, specifically: flipper. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-8052? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-0959 8.8

The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id …

CVE-2024-48988 7.6

SQL Injection vulnerability in Apache StreamPark. This issue affects Apache StreamPark: from 2.1.4 before 2.1.6. Users are recommended to upgrade …

CVE-2024-58352 7.5

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting …

CVE-2026-40871 7.2

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection …

CVE-2023-7249 9.8

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This …

CVE-2024-6360 9.8

Incorrect Permission Assignment for Critical Resource vulnerability in OpenText™ Vertica could allow Privilege Abuse and result in unauthorized access or …