CVE-2025-27378CWE-20CWE-89

SQL Injection in AES Due to Inactive SQL Parsing Configuration

High · published January 22, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

⚡ If your SQL parsing logic is snoozing, attackers might just take the wheel! 🚗💨 Think of it like a restaurant menu that doesn’t check for allergens — anyone can order anything, even if it’s harmful! In this case, the inactive configuration is like the kitchen ignoring safety protocols, allowing risky ingredients to slip in without a second glance. An attacker could craft input that executes arbitrary SQL queries, leading to unauthorized access to sensitive data, data manipulation, or even complete database compromise. The fallout could be absolutely devastating for your applications and the users relying on them!

Put simply

Think of it like a restaurant menu that doesn’t check for allergens — anyone can order anything, even if it’s harmful! In this case, the inactive configuration is like the kitchen ignoring safety protocols, allowing risky ingredients to slip in without a second glance. This SQL injection vulnerability arises from an inactive configuration that fails to apply necessary SQL parsing logic, allowing attackers to manipulate inputs unchecked and run their own SQL queries.

What to do

An attacker could craft input that executes arbitrary SQL queries, leading to unauthorized access to sensitive data, data manipulation, or even complete database compromise. The fallout could be absolutely devastating for your applications and the users relying on them! To protect against this issue, ensure that the relevant SQL parsing logic is activated in your configuration. Additionally, review and sanitize all user inputs to mitigate potential injection risks. Always keep your software up to date with the latest security patches! You've got this! Just follow these steps, and you’ll have your defenses strong and ready to keep those crafty attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00383 · 31.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-01-22T01:06Z
EPSS history
Timeline
  • 22 JAN 01:06Z
    SQL Injection in AES Due to Inactive SQL Parsing Configuration
    cvelistv5