CVE-2025-64293CWE-89sql-injection

CVE-2025-64293

High · published November 12, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

⚡ Watch out, Golemiq users! An SQL injection vulnerability lurking in versions up to 4.0.0 could allow attackers to craft sneaky commands and access your database! 🔥 Think of it like a restaurant where an unchecked patron can modify the chef's special recipe by simply whispering their changes to the waiter — nobody's verifying what’s being ordered, so bad things can happen! An attacker exploiting this SQL injection could gain access to sensitive data, manipulate records, or even take control of your entire database. This could lead to devastating data breaches or service interruptions, putting your organization at serious risk.

Put simply

Think of it like a restaurant where an unchecked patron can modify the chef's special recipe by simply whispering their changes to the waiter — nobody's verifying what’s being ordered, so bad things can happen! This vulnerability occurs due to improper neutralization of special elements in SQL commands within Golemiq 0 Day Analytics, allowing attackers to insert malicious SQL statements and execute unauthorized actions on the database.

What to do

An attacker exploiting this SQL injection could gain access to sensitive data, manipulate records, or even take control of your entire database. This could lead to devastating data breaches or service interruptions, putting your organization at serious risk. Immediate action is required: Update Golemiq to version 4.0.1 or later, implement parameterized queries to sanitize inputs, and conduct a thorough audit of your database access controls to ensure no unauthorized commands can be executed. You’ve got this! Follow these steps to secure your application and keep those databases safe! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-11-12T21:15Z
References (1)
EPSS history
Timeline
  • 12 NOV 15:52Z
    WordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerability
    cvelistv5