CVE-2025-52694

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Advantech	IoTSuite and IoT Edge Products	SaaSComposer prior to version V3.4.15; IoTSuite Growth Linux docker prior to version V2.0.2; IoTSuite Starter Linux docker prior to version V2.0.2; IoT Edge Linux docker prior to version V2.0.2; IoT Edge Windows prior to version V2.0.2; WebAccess/SCADA prior to version V9.2.2; WebAccess SaaS-Composer prior to version 3.4.15.1; ECOWatch SaaS-Composer prior to version 3.4.15

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/Mitigation, Third Party Advisory

Timeline

Published: Jan 12, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-52707.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and CVE-2025-527076.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fanc CVE-2025-527087.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY wo CVE-2025-52716.5Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in F CVE-2025-527105.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester a CVE-2025-527114.3Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Reques CVE-2025-527124.2Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This iss CVE-2025-527136.4Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Requ CVE-2025-527149.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows SQ CVE-2025-527157.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classif CVE-2025-527167.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acato WP REST Cache CVE-2025-527179.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allow