CVE-2025-53122CWE-89

SQLi in OpenNMS Horizon and Meridian

Medium · published June 26, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Injection.

Users

should upgrade to Meridian 2024.2.6 or newer, or Horizon 33.16 or newer. Meridian and

Horizon installation instructions state that they are intended for installation

within an organization's private networks and should not be directly accessible

from the Internet.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-06-26T19:49Z
EPSS history
Timeline
  • 26 JUN 19:49Z
    SQLi in OpenNMS Horizon and Meridian
    cvelistv5