CVE-2025-10437CWE-89sql-injection

CVE-2025-10437

Critical · published November 19, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
27.9
In the wild
Unconfirmed
What it is

🔥 A rogue SQL command could lead to total chaos! This vulnerability allows attackers to inject dangerous SQL code in the Webpack Management System — a situation that's absolutely devastating! Think of it like a restaurant accepting any order without checking the ingredients — a customer could ask for a dish that's not on the menu at all and get whatever they want, including something harmful! An attacker could exploit this vulnerability to gain unauthorized access to the database, allowing them to read, modify, or even delete critical data. This level of access could result in a complete compromise of the system, leading to data breaches and severe operational disruptions. Imagine the fallout for users and clients alike!

Put simply

Think of it like a restaurant accepting any order without checking the ingredients — a customer could ask for a dish that's not on the menu at all and get whatever they want, including something harmful! This SQL injection vulnerability stems from improper neutralization of special elements in SQL commands, enabling attackers to manipulate queries executed by the Webpack Management System. This allows malicious inputs to interact directly with the database, bypassing expected security protocols.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to the database, allowing them to read, modify, or even delete critical data. This level of access could result in a complete compromise of the system, leading to data breaches and severe operational disruptions. Imagine the fallout for users and clients alike! To protect your system, patch to the latest version immediately, validate all user inputs, and implement prepared statements for database queries. Conduct a thorough vulnerability assessment to ensure no other weaknesses exist. You've got this! By following these steps, you'll fortify your defenses and keep your data safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00354 · 27.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-11-19T17:15Z
References (2)
EPSS history
Timeline
  • 19 NOV 11:41Z
    SQLi in Exagate's Webpack Management System
    cvelistv5