CVE-2025-60265: Bestfeng Xckk

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In xckk v9.6, there is a SQL injection vulnerability in which the orderBy parameter in user/list is not securely filtered, resulting in a SQL injection vulnerability.

Affected products

• Bestfeng Xckk: version 9.6 only

Published 2025-10-09. Last modified 2026-06-17.