CVE-2025-57792

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. The issue is exploitable without authentication, significantly raising the risk.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Explorance	Blue	< 8.14.9

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0001.mdThird Party Advisory
https://online-help.explorance.com/blue/articles/security-advisories-(january-2026)Vendor Advisory
https://online-help.explorance.com/blue/articles/security-advisory:-cve-2025-57792Vendor Advisory
https://www.explorance.com/products/blueProduct

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577938.6Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a CVE-2025-577949.1Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. Th CVE-2025-577959.9Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default CVE-2025-577966.8Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, includi CVE-2025-577978.5Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. If this vulnerability is explo CVE-2025-577985.5Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions 3.6.14 and prior contain CVE-2025-577998.7StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an a CVE-2025-57807.5A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2025-578008.8Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict CVE-2025-578019.1gnark is a zero-knowledge proof system framework. In versions prior to 0.14.0, the Verify function in eddsa.go and ecdsa.go used the S value CVE-2025-578028.7Airlink's Daemon interfaces with Docker and the Panel to provide secure access for controlling instances via the Panel. In version 1.0.0, an CVE-2025-578038.8ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-28 and 7.1.2-2 for I