Is CVE-2025-55885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-55885 being exploited in the wild.

How severe is CVE-2025-55885?

Medium severity, with a CVSS score of 6.3, published 22 September 2025.

Which products and versions are affected?

Alpes Recherche et Developpement (ARD) GEC en Ligne before 2025-04-23.

Is there a fix for CVE-2025-55885?

A patch was published on 2025-04-23: Vendor released fix in version 2025-04-23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-55885 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-55885?

Check whether you run Ard Gec En Ligne. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-55885: Alpes Recherche et Developpement ARD GEC en Ligne SQL injection in index.php

CVE-2025-55885 · Severity: medium · CVSS 6.3 · Published 2025-09-22

Alpes Recherche et Developpement (ARD) GEC en Ligne, a web-based management platform often used in education and healthcare sectors, contains a security flaw that could allow an attacker to gain unauthorized access to data. By exploiting this vulnerability, a remote user with basic access could potentially escalate their privileges or extract sensitive information from the underlying database. This could lead to the exposure of user records or disruption of services.

Technologies: Ard Gec En Ligne. Vendors: Ard.

Quick answers

Is CVE-2025-55885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-55885 being exploited in the wild.
How severe is CVE-2025-55885?: Medium severity, with a CVSS score of 6.3, published 22 September 2025.
Which products and versions are affected?: Alpes Recherche et Developpement (ARD) GEC en Ligne before 2025-04-23.
Is there a fix for CVE-2025-55885?: A patch was published on 2025-04-23: Vendor released fix in version 2025-04-23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55885 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-55885?: Check whether you run Ard Gec En Ligne. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the 'ocid' GET parameter of the index.php transaction confirmation page in ARD GEC en Ligne. The application fails to properly sanitize user-supplied input before using it in a MySQL database query. An authenticated remote attacker can exploit this by sending specially crafted HTTP GET requests to extract sensitive information, such as user tables, or to escalate their privileges within the application. The vulnerability is addressed in versions released on or after April 23, 2025.

Affected products

Alpes Recherche et Developpement (ARD) GEC en Ligne before 2025-04-23

Timeline

2025-04-23: patched: Vendor released fix in version 2025-04-23
2025-09-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.