CVE-2025-3893CWE-89

SQL Injection in MegaBIP

High · published May 23, 2025

CVSS v4.0

8.6

EPSS

Percentile

33.9

In the wild

Unconfirmed

What it is

While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability.

Version 5.20 of MegaBIP fixes this issue.

The record

Technical detail

CVSS v4.0: 8.6 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00408 · 33.9th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-05-23T10:20Z

EPSS history

Timeline

23 MAY 10:20Z
SQL Injection in MegaBIP
cvelistv5