Critical · 9.9 CVE-2025-24290 EUVD-2025-19541GHSA-8hv4-jp7q-gqgc

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor …

Published Jun 29, 2025 · Updated Jun 30, 2025 · Assigned by hackerone

Vendor: Ubiquiti Product: UISP Application Category: Network devices

Description

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.

Affected products

Vendor	Product	Affected	Fixed
Ubiquiti	UISP Application	2.4.211 – < 2.4.211	2.4.211

References

https://community.ui.com/releases/Security-Advisory-Bulletin-048-048/af007d99-bb6d-4368-a12f-75e84de19e8d