CVE-2025-53122

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OpenNMS Horizon and Meridian applications allows SQL Injection. 

Users should upgrade to Meridian 2024.2.6 or newer, or Horizon 33.16 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-531318.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.CVE-2025-531327.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized atCVE-2025-531337.8Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.CVE-2025-531347.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSockCVE-2025-531357.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attackerCVE-2025-531365.5Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locCVE-2025-531377.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2025-531385.7Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information overCVE-2025-531397.1Cleartext transmission of sensitive information in Windows Hello allows an unauthorized attacker to bypass a security feature locally.CVE-2025-53146.1The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site ScCVE-2025-531407.0Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.CVE-2025-531417.8Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2025-53122: Medium severity, CVSS 6.9 | Vulnix