MSSQL
CVE-2025-61943
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
AnalysisAI
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server. [CVSS 8.4 HIGH]
Technical ContextAI
Classified as CWE-89 (SQL Injection). Affects Process Optimization. The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation.
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpo
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Mysql contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable cr
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affec
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Mysql Cluster contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repea
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today