CVE-2025-40886: Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering their structure and content, and/or affecting their availability.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40886?
CVE-2025-40886 has a high severity due to its potential for unauthorized access and data exposure.
How do I fix CVE-2025-40886?
To fix CVE-2025-40886, ensure proper validation and sanitization of input parameters used in the Alert functionality.
What are the potential impacts of CVE-2025-40886?
The impacts of CVE-2025-40886 include unauthorized execution of SQL statements and data exposure from the database.
Who is affected by CVE-2025-40886?
CVE-2025-40886 affects users of Guardian CMC versions up to 25.2.0 with authenticated access privileges.
How can I detect CVE-2025-40886 in my system?
You can detect CVE-2025-40886 by testing input validations in the Alert functionality for SQL injection vulnerabilities.