CVE-2025-67066: n/a

This vulnerability is a SQL Injection flaw in oasys sysoa version 1.0. An attacker can exploit the 'outtype' parameter in the /outaddresspaging endpoint to execute arbitrary code remotely. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the source data.

Successful exploitation allows a remote attacker to execute arbitrary code on the affected system, potentially leading to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the 'outtype' parameter. Avoid exposing the /outaddresspaging path to untrusted networks.