MSSQL
CVE-2025-61943
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
AnalysisAI
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server. [CVSS 8.4 HIGH]
Technical ContextAI
Classified as CWE-89 (SQL Injection). Affects Process Optimization. The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation.
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpo
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
Privilege escalation in SQL Server 2022 and 2025 stems from insufficient authentication controls on critical functions,
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Mysql contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable cr
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affec
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today