CVE-2025-8858

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

Clinic Image System developed by Changing has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-88598.8A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /natiCVE-2025-88603.3A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `CVE-2025-88619.8TSA developed by Changing has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete CVE-2025-88627.0YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigatCVE-2025-88637.0YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmissionCVE-2025-88646.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logsCVE-2025-88654.1The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain CVE-2025-88665.1YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attackCVE-2025-88676.4The Graphina - Elementor Charts and Graphs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple chart widget paramCVE-2025-88688.8In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef AutomateCVE-2025-88695.9When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PCVE-2025-88704.9On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153
CVE-2025-8858: High severity, CVSS 7.5 | Vulnix