What is the CVSS score of EUVD-2025-17232?

EUVD-2025-17232 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-17232?

A SQL injection vulnerability in Libro de Reclamaciones y Quejas (versions 0.9 and below) allows attackers to manipulate database queries, potentially exposing or modifying sensitive complaint and…

How to fix or mitigate EUVD-2025-17232?

Within 24 hours: Identify all systems running Libro de Reclamaciones y Quejas and isolate them from production networks if possible; disable external access to the application and restrict to VPN/internal networks only. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection payloads; conduct database activity monitoring for suspicious queries; deploy compensating controls listed below. Within 30 days: Evaluate alternative complaint management solutions; develop upgrade or replacement plan as vendor patches become available; perform forensic audit for evidence of exploitation.

Wordpress Plugin EUVD-2025-17232

| CVE-2025-30989 HIGH

SQL Injection (CWE-89)

2025-06-06 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17232

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.6

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas allows SQL Injection. This issue affects Libro de Reclamaciones y Quejas: from n/a through 0.9.

AnalysisAI

A SQL Injection vulnerability (CWE-89) exists in Renzo Tejada's 'Libro de Reclamaciones y Quejas' application versions up to 0.9, allowing authenticated attackers with high privileges to execute arbitrary SQL commands. While the CVSS score is 7.6 (High), the attack requires prior authentication and high-level privileges (PR:H), significantly reducing real-world exploitability. The vulnerability impacts confidentiality (data exfiltration) and limited availability, though integrity is not affected. Without confirmed KEV status, active exploitation data, or public proof-of-concept, this represents a medium-priority issue requiring patching but not immediate emergency response.

Technical ContextAI

The vulnerability stems from improper neutralization of special SQL characters in user-supplied input, a classic SQL Injection flaw (CWE-89). The application 'Libro de Reclamaciones y Quejas' (a Spanish-language complaints and claims management system) fails to implement adequate input validation or parameterized queries when constructing SQL statements. This allows attackers who have already authenticated and possess high-level privileges to inject malicious SQL syntax that modifies query logic. The affected product is a web or application-based system (implied by network accessibility: AV:N) for managing customer complaints, likely built with inadequate ORM protections or direct string concatenation in database queries. The specific CPE would be: cpe:2.3:a:renzo_tejada:libro_de_reclamaciones_y_quejas:*:*:*:*:*:*:*:* (versions 0.9 and earlier).

RemediationAI

Patching: Upgrade to version 0.10 or later (assumes patch released; verify with vendor); details: Contact Renzo Tejada or check official project repository for patched versions. No direct patch link available in provided intelligence. Input Validation & Parameterization: Implement parameterized queries/prepared statements; details: Replace all dynamic SQL string concatenation with prepared statements (bind parameters). Use ORM frameworks or database abstraction layers that enforce parameterization by default. Access Control: Restrict administrative/high-privilege accounts; details: Since PR:H is required, implement principle of least privilege. Limit number of users with admin access; audit admin account usage regularly. Detection & Monitoring: Monitor SQL logs for suspicious queries; details: Enable SQL query logging and monitor for unusual patterns: UNION SELECT, DROP, INSERT, script-like syntax in user-controlled fields. Web Application Firewall: Deploy WAF rules for SQL injection; details: If patching is delayed, use WAF to block common SQL injection payloads (UNION, CAST, CONVERT, comment sequences).