CVE-2025-27378: SQL Injection in AES Due to Inactive SQL Parsing Configuration
Published Jan 22, 2026
·Updated
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries.
Affected Software
1 affected component
Altium On-prem Enterprise Server>=7.0.3<7.0.6
Event History
Jan 22, 2026
CVE Published
via MITRE·01:06 AM
Data Sourced
via MITRE·01:06 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-27378?
The severity of CVE-2025-27378 is critical with a score of 9.8.
2
How do I fix CVE-2025-27378?
To fix CVE-2025-27378, enable the SQL parsing configuration to ensure proper handling of input.
3
What type of vulnerability is CVE-2025-27378?
CVE-2025-27378 is an SQL Injection vulnerability associated with input validation issues.
4
What software is affected by CVE-2025-27378?
CVE-2025-27378 affects the Altium On-prem Enterprise Server software.
5
What are the potential impacts of CVE-2025-27378?
The potential impacts of CVE-2025-27378 include unauthorized execution of arbitrary SQL queries, leading to data exposure or compromise.