CVE-2025-40887: Authenticated SQL Injection on Alert functionality in Guardian/CMC before 25.2.0
A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40887?
CVE-2025-40887 is classified as a critical SQL Injection vulnerability that allows an authenticated user to execute arbitrary SQL statements.
How do I fix CVE-2025-40887?
To fix CVE-2025-40887, ensure proper input validation and sanitization for parameters used in the Alert functionality of Guardian CMC.
Who is affected by CVE-2025-40887?
CVE-2025-40887 affects users of Guardian CMC versions up to and including 25.2.0.
What impact does CVE-2025-40887 have on my system?
CVE-2025-40887 could lead to unauthorized access to sensitive data by allowing an attacker to execute malicious SQL queries.
Is CVE-2025-40887 a known issue in the cybersecurity community?
Yes, CVE-2025-40887 has been publicly disclosed and acknowledged within the cybersecurity community.