sql injection

Rockwell Automation’s FactoryTalk DataMosaix Private Cloud contains a high‑severity SQL injection vulnerability that lets low‑privilege users perform sensitive database operations through exposed API endpoints — a flaw assigned CVE‑2025‑12807 with a CVSS v3.1 base score of 8.8 (CVSS v4 ≈ 8.7)...

CISA’s update to the Known Exploited Vulnerabilities (KEV) Catalog once again throws a spotlight on Fortinet’s FortiWeb appliances — but the record is more complicated than a single line item. Federal agencies and enterprise defenders were warned to act quickly after CISA confirmed active...

An attacker who successfully exploits CVE-2025-59499 can inherit the privileges of the process that runs the vulnerable query — in other words, exploitation can grant whatever SQL Server-level or OS-level rights the targeted process holds; if the vulnerable query executes under a principal that...

Siemens has released a security advisory and a fix for a high-severity SQL injection vulnerability in SINEC NMS, tracked as CVE-2025-40755, that affects all SINEC NMS builds prior to V4.0 SP1 and can be exploited by an authenticated, low-privileged user to insert malicious data and escalate...

Microsoft has published an advisory for CVE-2025-59213, a high-severity SQL injection vulnerability in Microsoft Configuration Manager that can be abused for local elevation of privilege; administrators must urgently verify the exact KB mapping for their Configuration Manager branch and deploy...

Microsoft’s advisory URL for CVE-2025-55227 does not resolve to a public advisory, and the identifier CVE-2025-55227 cannot be located in Microsoft’s Security Update Guide or the major vulnerability databases; the evidence available instead points to a closely related Microsoft SQL Server...

ESET’s researchers have uncovered a previously undocumented threat cluster that covertly poisons legitimate IIS-hosted websites to manipulate Google rankings while also planting a stealthy C++ backdoor on Windows servers — a campaign ESET calls GhostRedirector that, according to an internet-wide...

ESET Research has uncovered a previously undocumented threat actor it calls GhostRedirector, which in June 2025 was found to have compromised at least 65 Windows servers across multiple countries and deployed two custom tools — a C++ backdoor named Rungan and a native IIS module named Gamshen...

CISA has added CVE-2025-57819 — an authentication‑bypass and SQL‑injection chain that can lead to remote code execution in Sangoma FreePBX — to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and urging immediate remediation. Background FreePBX is a...

Siemens has disclosed a broad, high-severity set of vulnerabilities affecting the SINEC family—spanning SINEC NMS, SINEC INS and devices running SINEC OS—and vendors and operators must treat these as urgent operational risks: multiple advisories published by Siemens ProductCERT show...

Microsoft’s advisory for CVE-2025-47954 describes an SQL Injection–style weakness in Microsoft SQL Server that can allow an authenticated actor to escalate privileges across the network — a high‑impact finding that requires immediate attention from DBAs and security teams. Background / Overview...

Microsoft’s advisory language about an SQL injection–style elevation of privilege in SQL Server is serious — but the identifier you supplied, CVE-2025-49759, does not appear in the major public vulnerability trackers I reviewed; instead, Microsoft’s July 8, 2025 SQL Server fixes included a...

CVE-2025-53727 is a SQL Server vulnerability that stems from improper neutralization of special elements used in an SQL command (SQL injection) and — according to Microsoft’s advisory — can allow an authenticated attacker to elevate privileges over a network. What happened (plain English)...

Note: you supplied the MSRC page for CVE-2025-49758 . I attempted to programmatically fetch the MSRC content but the page is rendered with JavaScript and I could not retrieve the full advisory text automatically. Below I’ve written a thorough, actionable, and vendor-agnostic 2000+ word article...

The evolving landscape of cybersecurity challenges underscores that no organization, regardless of size or sector, can afford complacency. This reality was highlighted once again as the Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of a new entry to its Known...

Regarded as a cornerstone in industrial network management solutions, Siemens SINEC NMS has played a pivotal role in enabling organizations across the globe to centrally control, monitor, and secure their operational technology (OT) infrastructure. With deployment spanning critical manufacturing...

Advantech’s iView, long a staple in network management within industrial control systems, is facing a turbulent moment as serious cybersecurity threats demand immediate attention from critical infrastructure operators around the globe. A comprehensive technical advisory released by CISA reveals...

Microsoft Configuration Manager, a linchpin in enterprise environments for managing devices, applications, and updates, has been thrust into the cybersecurity spotlight again following the disclosure of CVE-2025-47178. This newly unearthed vulnerability underscores not only the intricate...

ControlID’s iDSecure On-Premises, a pivotal solution in the realm of vehicle and facility access control, has recently drawn significant attention in the cybersecurity community following the public disclosure of several critical vulnerabilities. These weaknesses, which affect all versions up to...

CVE-2025-47172 is a critical vulnerability in Microsoft SharePoint Server that allows authorized attackers to execute arbitrary code over a network due to improper neutralization of special elements used in SQL commands, commonly known as SQL injection. This vulnerability affects multiple...