Sql Server 2022
CVE-2025-47954
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network. Affected products include: Microsoft Sql Server 2022.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
More in Sql Server 2022
View allSQL Server 2016-2025 contains an improper access control flaw that allows authenticated network attackers to escalate pr
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized
Privilege escalation in SQL Server 2016-2025 stems from insufficient input validation, enabling authenticated network at
Authenticated users can exploit SQL injection vulnerabilities in SQL Server 2016-2025 to escalate privileges and gain un
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
Improper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
Privilege escalation in SQL Server 2022 and 2025 stems from insufficient authentication controls on critical functions,
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized
Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized a
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today