CVE-2025-13774CWE-89

SQL injection leading to privilege escalation in Progress Flowmon ADS

High · published January 13, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

⚡ An SQL injection vulnerability lurking in Progress Flowmon ADS can let authenticated users execute unintended queries! 🔥 Think of this as a trusted employee who misfiles important paperwork, allowing anyone to access confidential company records without going through the proper channels. One misplaced query can lead to chaos! An attacker could exploit this vulnerability to run unauthorized SQL commands, potentially accessing or altering sensitive information within the database. This could lead to a serious data breach, impacting both the integrity and confidentiality of your system. The stakes are high, and the consequences could be absolutely devastating!

Put simply

Think of this as a trusted employee who misfiles important paperwork, allowing anyone to access confidential company records without going through the proper channels. One misplaced query can lead to chaos! This SQL injection flaw permits authenticated users to manipulate the database by injecting malicious SQL queries, bypassing intended access controls. The issue affects Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1.

What to do

An attacker could exploit this vulnerability to run unauthorized SQL commands, potentially accessing or altering sensitive information within the database. This could lead to a serious data breach, impacting both the integrity and confidentiality of your system. The stakes are high, and the consequences could be absolutely devastating! To address this vulnerability, upgrade to Progress Flowmon ADS version 12.5.4 or 13.0.1 immediately. Additionally, review your SQL query handling practices, and consider implementing prepared statements to enhance security. Don't delay in addressing this! You've got this! Follow these steps, and you'll ensure your system is secure in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-13T12:59Z
EPSS history
Timeline
  • 13 JAN 12:59Z
    SQL injection leading to privilege escalation in Progress Flowmon ADS
    cvelistv5