CVE-2025-5176 is a high severity (CVSS 7.3) SQL injection in Realce Tecnologia Queue Ticket Kiosk (up to 20250517). The Usuário argument handled by /adm/index.php is passed into a database query unsafely, and the record says it can be attacked remotely. No fixed version is confirmed, so check with the vendor.
What's affected
Realce Tecnologia Queue Ticket Kiosk versions up to 20250517 are affected. The vulnerable code is /adm/index.php, and the weak input is the Usuário argument, per the record. The record says the vendor was contacted early and did not respond. The component is the admin login page.
The record names no patched release. The references point to a VulDB entry and a researcher write-up, not a vendor advisory, so I cannot confirm that a fix exists. If you run this software, treat the affected version as vulnerable and check the vendor or project page for a newer build.
The CVSS vector lists no privileges as the access needed, so read the score with that in mind. The affected field is the username on the admin login page.
How to check if you're exposed
First find out whether you run it. Look for the product name in your application inventory and hosting accounts, and check for the file named above on any web server:
find /var/www -name "index.php" 2>/dev/null
If you have the source, search for the argument name near database calls and look for queries built by joining strings:
grep -rn "Usuário" --include=*.php .
Then check the access logs for unusual requests to that path, such as very long values or SQL keywords in the parameter. Do not test live systems you do not own.
You can also run the free in-browser dependency scan at gold.safeguard.sh/scan, which checks the packages your own projects use against the Gold directory. It will not find a commercial product installed on a server, so pair it with an inventory of what runs where.
What to do now
- Confirm whether this product and version run anywhere in your estate, including forgotten demo or test sites.
- Check the vendor or project page for a fixed release. If there is none, plan to replace the software.
- Take the vulnerable page off the public internet. Put it behind a VPN or an allow list of known addresses.
- If you maintain the code, switch the query to a parameterized form so input is never part of the SQL text:
$stmt = $pdo->prepare('SELECT * FROM items WHERE name = :name');
$stmt->execute([':name' => $input]);
- Review database accounts used by the app and remove any rights it does not need, then review logs for the path above.
Why it matters
The weakness classes are CWE-74 (Injection), CWE-89 (SQL Injection). SQL injection happens when input is concatenated into a query, so the database cannot tell the developer's SQL from the user's data. It is one of the oldest and best understood bugs, and the cure is equally old: parameterized queries and least privilege database accounts.
The record says the exploit has been disclosed publicly. It does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild. Small packaged web apps like this often sit unmaintained on shared hosting, which is why public details matter even at a high score.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of Queue Ticket Kiosk?
I could not confirm one. The record lists no fixed version and the references are not a vendor advisory, so check the vendor or project page and plan a replacement if nothing is offered.
What does the score of 7.3 tell me?
It is a high rating. The vector shows a remote attack with low complexity and needing no privileges, with limited impact on confidentiality, integrity and availability. Your own exposure depends on whether the page is reachable.
Sources
Last reviewed: 18 October 2026.
