- Description
- A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .
- Source
- cve@mitre.org
- NVD status
- Analyzed
- Products
- mjobtime
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-89
- Hype score
- Not currently trending
🚨 Construction Firms Targeted via mJobTime Blind SQLi to Trigger MSSQL xp_cmdshell RCE Attackers are exploiting a blind SQL injection in **mJobTime v15.7.2** (CVE-2025-51683) by sending crafted IIS **POST** requests to `/Default.aspx/update_profile_Server`, enabling
@ThreatSynop
30 Jan 2026
37 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 CVE-2025-51683 : CRITICAL SQLi ALERT 🚨 @mJobtime A critical unauthenticated blind SQL injection vulnerability has been disclosed in mJobtime, a workforce management and time-tracking platform widely used in construction and field service industries. Risk Severity: Criti
@OstorlabSec
27 Jan 2026
33 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Legit construction software quietly exposed backend MSSQL. Attackers took advantage via blind SQL injection (CVE-2025-51683). No malware required. Just xp_cmdshell and permissions doing their job. Inventory your dependencies, not just your apps. https://t.co/aLrIBBzYsH
@HuntressLabs
24 Jan 2026
7990 Impressions
9 Retweets
53 Likes
11 Bookmarks
0 Replies
1 Quote
CVE-2025-51683 A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the … https://t.co/qvGyUKz62w
@CVEnew
1 Dec 2025
149 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
We've published technical details for CVE-2025-51682 and CVE-2025-51683 – two vulnerabilities in the time management software mJobTime that lead to unauthenticated RCE via SQLi by @dario_weiss: https://t.co/CP9sNeRdQH
@InfoGuard_Labs
25 Nov 2025
190 Impressions
2 Retweets
5 Likes
3 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mjobtime:mjobtime:15.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC0C873D-A6A8-4FB3-A7AC-07DBC8ED72A9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]