CVE-2025-20272

MediumCVSS 4.3/10Last modified Jun 29, 2026

Description

A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 16, 2025
Last modified: Jun 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-202736.1A vulnerability in the web-based management interface of Cisco Unified Intelligent Contact Management Enterprise could allow an unauthentica CVE-2025-202748.8A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to CVE-2025-202757.8A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated atta CVE-2025-202767.2A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrar CVE-2025-202776.7A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary CVE-2025-202786.7A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitra CVE-2025-202794.8A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored CVE-2025-20285.3Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs CVE-2025-202804.8A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure co CVE-2025-2028110.0A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code o CVE-2025-2028210.0A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files CVE-2025-202837.2A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary code on