CVE-2025-47902

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 20, 2025
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-479044.1Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue afCVE-2025-479055.4Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, becaCVE-2025-479066.5If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("CVE-2025-479077.0Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned RowsCVE-2025-479087.5Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-RequesCVE-2025-479097.3Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacksCVE-2025-47919.8A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the componCVE-2025-479105.4When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginPCVE-2025-479115.3The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial oCVE-2025-479125.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 pCVE-2025-479137.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-479145.3SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the me