EUVD-2026-39408
GHSA-qq5f-hjr7-p57f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the specific prerequisite that the attacker's IP must fall within an active Nessus scan scope, which is not a default or guaranteed condition; PR:N because no Nessus credentials are required.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
AnalysisAI
SQL injection in Tenable Nessus exposes scan-result databases to exfiltration by any remote unauthenticated attacker who controls the reverse DNS (PTR) records for a host being scanned. When Nessus resolves the hostname of a scanned target via PTR lookup, the returned value is incorporated into a SQL query without adequate sanitization, enabling read-level access to the scan results database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must control the reverse DNS (PTR) record for at least one IP address that is included in the scope of a Nessus scan. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 5.3 (Medium) vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N captures a remote unauthenticated read-only injection path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who owns or controls an internet-facing IP address configures its PTR record to contain a SQL injection payload (e.g., a UNION SELECT or stacked query). When a security team runs a Nessus scan that includes this IP, Nessus performs a reverse DNS lookup and the malicious PTR value is inserted into a scan-result SQL query, executing the injected SQL against the results database. … |
| Remediation | Apply the update referenced in Tenable advisory TNS-2026-17 at https://www.tenable.com/security/tns-2026-17 - exact patched version numbers should be confirmed there, as they are not independently specified in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for n
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of servi
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy cred
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to
Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.Io: before Plugin Feed ID #202306261202 ; N
As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. Rated h
A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.
An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with a
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrit
Nessus 8.5.2 and earlier on Windows platforms were found to contain an issue where certain system files could be overwri
Nessus 6.6.2 - 6.10.3 contains a flaw related to insecure permissions that may allow a local attacker to escalate privil
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today