Cyber Resilience

CVE-2025-14598

CriticalPublic PoC

Published: 09 January 2026

Published
09 January 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0069 47.9th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-14598 is a critical-severity SQL Injection (CWE-89) vulnerability in Cloudilyaerp Bet E-Portal. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-14598 is an SQL injection vulnerability (CWE-89) in the login functionality of BeeS Software Solutions BET Portal, affecting sites that utilize this software. Published on 2026-01-09, it enables attackers to execute arbitrary SQL commands on the backend database. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread impact.

The vulnerability is exploitable remotely over the network by unauthenticated attackers with low attack complexity and no requirement for user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability of the database, allowing arbitrary data extraction, modification, or deletion.

Mitigation guidance and additional details are available in the following advisories and references: https://afnaan.me/cve/cve-2025-14598, https://cloudilyaerp.com/, https://github.com/Afnaan-Ahmed/CVE-2025-14598, and https://www.kb.cert.org/vuls/id/361400.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQL commands to be executed on the backend database.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web login directly enables remote exploitation of the application for arbitrary DB access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89
CVE-2024-53544Shared CWE-89
CVE-2026-21410Shared CWE-89

Affected Assets

cloudilyaerp
bet e-portal
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents SQL injection in login functionality by enforcing input validation and error handling on user-supplied data before database queries.

SI-2 Flaw Remediation good match
prevent

Remediates the specific SQL injection flaw in BET Portal through timely identification, testing, and patching of the vulnerable login code.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection with web application firewalls monitors and blocks SQL injection payloads targeting the remote login endpoint.

References