Critical Devolutions Server Flaw (CVE-2025-13757) Allows Authenticated SQL Injection to Steal All Passwords

Devolutions has issued urgent security updates for its password management solution, Devolutions Server, addressing three critical vulnerabilities. The most severe, CVE-2025-13757, is a high-risk SQL injection flaw (CVSS 9.4) that allows authenticated users to exfiltrate or modify data via the DateSortField parameter in usage logs. The second vulnerability, CVE-2025-13758 (CVSS 5.1), improperly transmits passwords in metadata requests, risking exposure during data retrieval.

The third, CVE-2025-13765 (CVSS 4.9), allows unauthorized users to access email service passwords. Administrators are urged to update to versions 2025.2.21 or higher to mitigate these risks.