CVE-2025-8868

HighCVSS 8.8/10Last modified Oct 9, 2026

Description

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via

improperly neutralized inputs used in an SQL command using a well-known token.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2025
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-88695.9When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement P CVE-2025-88704.9On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 CVE-2025-88715.6The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deseriali CVE-2025-88726.5On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU ut CVE-2025-88737.5On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IP CVE-2025-88746.4The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnera CVE-2025-88757.8Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025 CVE-2025-88768.8Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.CVE-2025-88777.5The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to,CVE-2025-88786.5The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for Wor CVE-2025-88798.8Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via CVE-2025-88808.8Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML