CVE-2026-25606

HighCVSS 8.7/10Last modified Jul 23, 2026

Description

A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access

This issue was fixed in version 9.5.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-256075.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with CVE-2026-256082.3STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain CVE-2026-256094.3Incorrect validation of the profile command may result in the determination that a request altering the 'filter' is read-only.CVE-2026-25618.8A vulnerability was found in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This affects the function web_get_ddns_uptime of the file /jdca CVE-2026-256106.5An authorized user may trigger a server crash by running a $geoNear pipeline with certain invalid index hints.CVE-2026-256117.5A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.CVE-2026-256126.5The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collec CVE-2026-256136.5An authorized user may disable the MongoDB server by issuing a query against a collection that contains an invalid compound wildcard index.CVE-2026-256147.5Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.CVE-2026-256157.2Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.CVE-2026-256166.1Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.CVE-2026-25628.8A vulnerability was determined in JingDong JD Cloud Box AX6600 up to 4.5.1.r4533. This impacts the function cast_streen of the file /jdcapi