CVE-2025-40886

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SQL statements on the DBMS used by the web application, potentially exposing unauthorized data, altering their structure and content, and/or affecting their availability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 7, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-408876.5A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated uCVE-2025-408886.5A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated useCVE-2025-408898.1A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenCVE-2025-40895.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, poCVE-2025-408907.9A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.CVE-2025-408914.7A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network tCVE-2025-408928.9A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. AnCVE-2025-408936.1A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An CVE-2025-408945.4A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input parCVE-2025-408954.8A Stored HTML Injection vulnerability was discovered in the CMC's Sensor Map functionality due to improper validation on connected GuardiansCVE-2025-408964.8The server certificate was not verified when an Arc agent connected to a Guardian or CMC. A malicious actor could perform a man-in-the-miCVE-2025-408978.1An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being prope
CVE-2025-40886: High severity, CVSS 8.8 | Vulnix