CVE-2025-52694

Execution of arbitrary SQL commands

Critical · published January 12, 2026

CVSS v3.1
10.0
EPSS
40%
Percentile
98.6
In the wild
Unconfirmed
What it is

🚨 A single SQL command could unleash chaos — an unauthenticated remote attacker can stroll right in and manipulate your entire database! 🔥 This vulnerability is like a delivery driver who blindly accepts any package for drop-off without checking the address — one wrong entry could lead to an entire shipment going to the wrong destination, with potentially devastating results. If exploited, this SQL injection could allow an attacker to execute arbitrary SQL commands, allowing them to steal sensitive data, modify it, or even delete everything on your database. The consequences could be catastrophic, affecting data confidentiality, integrity, and availability, leaving your systems wide open. You definitely don’t want to be the one responsible for that kind of mess!

Put simply

This vulnerability is like a delivery driver who blindly accepts any package for drop-off without checking the address — one wrong entry could lead to an entire shipment going to the wrong destination, with potentially devastating results. This vulnerability enables an unauthorized remote attacker to inject malicious SQL commands into the application, affecting the database directly. It's like leaving the door to your data center wide open, allowing anyone on the internet to walk in and mess with your database at will.

What to do

If exploited, this SQL injection could allow an attacker to execute arbitrary SQL commands, allowing them to steal sensitive data, modify it, or even delete everything on your database. The consequences could be catastrophic, affecting data confidentiality, integrity, and availability, leaving your systems wide open. You definitely don’t want to be the one responsible for that kind of mess! Patch to the latest version immediately to close this critical gap! Ensure your configuration prevents external access to the database and consider implementing parameterized queries to protect against future SQL injection attacks. Don't leave your database vulnerable! You've got this! Follow these steps, and you'll lock things down in no time! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.39909 · 98.6th percentile
Published
2026-01-12T02:27Z
EPSS history
Timeline
  • 12 JAN 02:27Z
    Execution of arbitrary SQL commands
    cvelistv5