VulnSocial

CVE-2025-41029Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (4 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameter 'phonenumber' in '/private/continue-upload.php'.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-04-21: 4PoC Mentioned / Linked · 2026-04-21: 1Technical Details · 2026-04-21: 404-21
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2025-41029 SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sendin… https://www.cve.org/CVERecord?id=CVE-2025-41029

    Post summary

    The text announces CVE‑2025‑41029 as a SQL injection flaw in Zeon Academy Pro that can enable attackers to perform full database CRUD operations, but it provides no PoC, active exploitation evidence, or patch information.

    00010172
    57.2K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2025-41029 SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sendin… https://www.cve.org/CVERecord?id=CVE-2025-41029 ----- Traducción: Vulnerabilidad de … http://infoflow.cloud`

    Post summary

    The post announces the CVE-2025-41029 SQL injection vulnerability in Zeon Academy Pro, providing technical details but no evidence of exploitation or remediation.

    00000188
    72 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2025-41029: SQL injection in Zeon Academy Pr... Unauthenticated SQLi in `/private/continue-upload.php` via `phonenumber` param = instant database takeover with zero ef... https://zerodaysignal.com/vulnerability/CVE-2025-41029 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post discloses CVE-2025-41029, describing a critical unauthenticated SQL injection that could result in instant database takeover, and provides a link to additional details but no exploitation tool or patch information.

    00000264
    218 followersView on X
  • INCIBE-CERT@incibe_cert
    Disclosure

    ⚠️#INCIBEaviso | Inyección SQL en Zeon Academy Pro de #ZeonGlobalTech #CVE CVE-2025-41029 https://incibe.es/incibe-cert/alerta-temprana/avisos/inyeccion-html-en-php-point-sale-0 #AvisosDeSeguridad #TI #CNA #0day

    Post summary

    The post announces the newly disclosed CVE‑2025‑41029, describing a SQL injection flaw in Zeon Academy Pro, without any information on exploitation, patches, or PoC.

    00000108
    42.7K followersView on X

Explore more

Back to dashboard