CVE-2026-25606CWE-89

SQL Injection in STER

High · published May 22, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any

other data that the application itself is able to access

This issue was fixed in version 9.5.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-22T09:14Z
EPSS history
Timeline
  • 22 MAY 09:14Z
    SQL Injection in STER
    cvelistv5