Is CVE-2025-67805 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67805 being exploited in the wild.

How severe is CVE-2025-67805?

Medium severity, with a CVSS score of 5.9, published 1 April 2026.

Which products and versions are affected?

Sage Sage DPW Prior to 2025_06_004.

Is there a fix for CVE-2025-67805?

A patch was published on 2025-06-03: Feature forcibly disabled in version 2025_06_003 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67805 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-67805?

Check whether you run Sagedpw Sage Dpw. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67805: A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the…

CVE-2025-67805 · Severity: medium · CVSS 5.9 · Published 2026-04-01

Sage DPW is a human resources and payroll software suite used by organizations to manage employee data and financial records. A security flaw in the Database Monitor feature could allow unauthorized individuals to access sensitive diagnostic information, including password hashes and database table names. This issue only affects on-premise installations where this specific monitoring feature was manually enabled, and it does not impact the Sage DPW Cloud service.

Technologies: Sagedpw Sage Dpw. Vendors: Sagedpw.

Quick answers

Is CVE-2025-67805 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67805 being exploited in the wild.
How severe is CVE-2025-67805?: Medium severity, with a CVSS score of 5.9, published 1 April 2026.
Which products and versions are affected?: Sage Sage DPW Prior to 2025_06_004.
Is there a fix for CVE-2025-67805?: A patch was published on 2025-06-03: Feature forcibly disabled in version 2025_06_003 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67805 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-67805?: Check whether you run Sagedpw Sage Dpw. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in the Database Monitor module of Sage DPW due to missing authentication for critical diagnostic endpoints. The vulnerability is located within the `/scripts/cgiip.exe/WService=dpw_mand/a-905x.r` endpoints. An unauthenticated remote attacker can exploit this to retrieve sensitive data including emails, password hashes, salts, and database table names. This vulnerability only manifests in non-default, on-premise configurations where the Database Monitor has been manually enabled; it is disabled by default and unavailable in Sage DPW Cloud. The vendor addressed this by forcibly disabling the feature in version 2025_06_003 and providing a formal fix in 2025_06_004.

Affected products

Sage Sage DPW Prior to 2025_06_004

Timeline

2025-06-03: patched: Feature forcibly disabled in version 2025_06_003
2026-03-24: disclosed: Vulnerability details shared via public advisory
2026-04-01: advisory: CVE-2025-67805 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.