EUVD-2025-201691Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with valid low-privilege credentials
-
ExploitSubmit crafted input to vulnerable parameter
-
ExecutionBackend executes injected SQL
-
ImpactRead/exfiltrate arbitrary database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires valid authenticated access to the Vitals ESP application (PR:L) - a registered user account is a hard prerequisite, so unauthenticated internet attackers cannot exploit it directly. Once authenticated, no additional user interaction (UI:N) or special non-default configuration is indicated; the attacker sends crafted SQL through a vulnerable input parameter over the network. Impact is limited to reading database contents (VC:H, VI:N/VA:N) - no data modification or service disruption results from this flaw alone. Affects Vitals ESP versions 0 through 6.3. |
| Impact | This is a moderate-priority issue rather than an urgent one. The CVSS 4.0 score of 7.1 reflects a network-reachable (AV:N), low-complexity (AC:L) SQL injection with high confidentiality impact (VC:H) but no integrity or availability impact (VI:N/VA:N) and no scope change (SC:N) - consistent with a read-only data-disclosure flaw. Crucially, it requires authentication (PR:L), which meaningfully narrows the attacker population to users who already hold valid Vitals ESP credentials. Exploitation signals are weak: EPSS is 0.06% (17th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the provided sources. No SSVC decision data was supplied. The signals are internally consistent - a genuine but access-gated data-read vulnerability in a regionally-deployed enterprise product - so this warrants routine patching prioritization rather than emergency response, with elevated attention only for organizations exposing Vitals ESP to many low-trust authenticated users. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege authenticated access to a Vitals ESP portal submits crafted input into a vulnerable parameter, injecting arbitrary SQL that the backend executes against the database. Because the flaw permits reading arbitrary database contents, the attacker enumerates and exfiltrates sensitive records such as user accounts, credentials, or business data. No public exploit code is identified at time of analysis, and low attack complexity means a working payload is straightforward to develop once access is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Authenticated SQL injection in Galaxy Software Services' Vitals ESP (versions 0 through 6.3) lets a logged-in user pass crafted SQL through a vulnerable application input and read arbitrary data from the underlying database. Exploitation requires a valid Vitals ESP account - the CVSS vector records PR:L (authenticated), so an unauthenticated internet attacker cannot trigger it directly - but no further user interaction or non-default configuration is needed once access is obtained. Impact is confined to confidentiality (VC:H) with no integrity or availability effect, and there is no public exploit code or CISA KEV entry at time of analysis; EPSS is 0.06% (17th percentile), consistent with a moderate-priority, internally-exposed issue rather than an urgent one.
Earlier versions of this analysis (1)
RemediationAI
Patch status is not confirmed in the provided intelligence: no fixed version is named in the references, so treat this as "no vendor-released patch identified at time of analysis" and obtain the current release and fixed-build guidance directly from Galaxy Software Services via the TWcert advisory pages (https://www.twcert.org.tw/en/cp-139-10543-380bd-2.html, https://www.twcert.org.tw/tw/cp-132-10542-4c682-1.html). Until an upgrade is applied, the highest-value control is reducing the authenticated attack surface: enforce least privilege so ordinary Vitals ESP users cannot reach the affected input paths, and audit or restrict which accounts and roles can invoke them (trade-off: legitimate users may lose access to the impacted feature). Because exploitation needs a valid login, tightening account provisioning, removing stale/dormant accounts, enabling MFA and reviewing authentication logs for anomalous query-shaped input are effective compensating measures with low operational cost. Deploy a WAF or reverse proxy in front of Vitals ESP with SQL-injection signatures tuned to the platform's parameters (trade-off: false positives on legitimate search/query strings and no protection against an authenticated insider bypassing the proxy). Run the Vitals ESP database account with read-only privileges on tables it does not need to write, so a successful injection cannot escalate into modification (trade-off: may break features that require writes). Finally, monitor database and application logs for unusual SELECT patterns, wide table enumeration, or bulk result sets originating from a single session, since the read-only nature of the flaw means exfiltration - not corruption - is the detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-89 improper neutralization of special elements used in an SQL command: user-supplied input reaching a database query on the Vitals ESP web application is not safely parameterized or escaped, so SQL syntax can be injected. Vitals ESP is an enterprise knowledge-management / document collaboration platform from Galaxy Software Services (GSS), typically deployed on-premises inside corporate networks and exposed to employees rather than the open internet - which is why the authenticated prerequisite matters more here than remote reachability. CPE data (cpe:2.3:a:gss:vitalsesp:*:*:*:*:*:*:*:*) and the EUVD affected-version range (0 through 6.3) indicate the defect is present across the entire release history up to and including 6.3 rather than in a single build, suggesting a long-standing query-construction pattern in one or more input handlers. Because the assessed impact is read-only (VC:H, VI:N, VA:N), the practical risk is bulk exfiltration of content stored in the Vitals ESP database - documents, user records, metadata and any credentials or tokens persisted in adjacent tables - rather than tampering or denial of service. TWcert assigned the identifier and published the advisory, and the CVE cross-references ENISA EUVD-2025-201691.
Know when Vitalsesp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable low-complexity SQLi requiring an authenticated account (PR:L); read-only data disclosure gives C:H with I:N/A:N and no scope change.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
4DescriptionCVE.org
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Executive ViewAI
Organizations using Vitals ESP developed by Galaxy Software Services should be aware of notable risk from CVE-2025-14254, a SQL injection vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: deploy WAF rules, restrict network access, enable logging.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authenticated SQL injection in Vitals ESP versions 0 through 6.1 (Galaxy Software Services) allows a remote attacker hol
Arbitrary file read in Vitals ESP (Galaxy Software Services) versions 0 through 6.3 lets a remote attacker who already h
GitHub PoC
Exploit-DB